CVE-2026-110958

10.0Critical

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

10.0Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-119, CWE-122

Impact

Remote, unauthenticated attackers can execute arbitrary code on the router by sending malicious requests to api.cgi. Exploitation is publicly available and requires only network access to the web interface.

Root cause

A heap-based buffer overflow in api.cgi caused by unsafe handling and shell command construction via system() instead of structured argument execution.

Affected systems

Wavlink WN530HG4B version M30HG4B_V260724

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Fix & remediation

Flash firmware version 2026-09-24-841a51c6d5_tclinux.bin immediately. As an interim mitigation, block or isolate network access to the router's web management interface (specifically api.cgi) from untrusted networks.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110958