IT SBIT Services
Schneeberger
DEEN
CVE tracker

Wavlink WN530HG4B: Heap-based buffer overflow in api.cgi

CVE-2026-110958Critical 9.3Public exploit

← All vulnerabilities

Summary

The api.cgi handler of the Wavlink WN530HG4B Wi-Fi router firmware M30HG4B_V260724 contains a heap-based buffer overflow (CWE-119, CWE-122). A remote, unauthenticated attacker can exploit it over the network to potentially take full control of the device, read or change its traffic and settings, or disrupt its availability. A proof-of-concept exploit is publicly available. VulDB and a third-party source report that firmware 2026-09-24-841a51c6d5_tclinux.bin fixes the issue, but Wavlink has not published an advisory that we could verify.

Affected

  • Wavlink WN530HG4B, firmware M30HG4B_V260724
  • Other firmware versions are not confirmed as affected by the sources reviewed.

Fixed in

  • Firmware 2026-09-24-841a51c6d5_tclinux.bin (per VulDB and OpenCVE; not confirmed by a Wavlink advisory)
  • Confirm that the image matches your exact hardware revision, as the download filename references WN530BE2.

Workaround

  • Unknown. No vendor-published workaround was found.
  • Until patched: disable remote/WAN administration and port forwarding to the web interface, limit admin access to the LAN, change default credentials, and do not expose the device directly to the internet.

Exploitation

  • Public proof-of-concept exploit: yes (VulDB, CISA SSVC 'poc').
  • Automatable: yes. Technical impact: total (CISA SSVC).
  • Known exploitation in the wild: no evidence found; not listed in CISA KEV as far as the sources show.

Our recommendation

  • Inventory all Wavlink devices and verify the firmware version.
  • If the device is in use and not yet patched, update to the fixed firmware after confirming the correct build for your hardware revision.
  • Remove any WAN exposure of the admin interface immediately.
  • If the device cannot be updated or is end-of-life, replace it with supported equipment.
  • Monitor the device for unusual logins or configuration changes.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:36.

Original description (NVD)

A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed