{"id":"CVE-2026-110958","aliases":["EUVD-2026-102150","GHSA-456r-r3m7-3f5f"],"status":"published","title":"Wavlink WN530HG4B api.cgi heap-based overflow","description":"A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: \"We confirm the finding, and it has already been addressed. In the current firmware the api=info\u0026client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked.\"","severity":{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0102,"percentile":0.63846,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-119","CWE-122"],"published":"2026-10-15T15:30:18Z","modified":"2026-10-15T19:56:13Z","exploits":[{"source":"pocgithub","id":"shlln/CVE-2026-110958","title":"shlln/CVE-2026-110958","date":"2026-10-15","url":"https://github.com/shlln/CVE-2026-110958"}],"products":[{"vendor":"wavlink","product":"wn530hg4b"}],"references":[{"url":"https://vuldb.com/vuln/420571","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/420571/cti","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-110958","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/933388","tags":["third-party-advisory"]},{"url":"https://drive.google.com/file/d/12OOh8g9YDCbD-Q4cc52J6TH9KuOoD44A/view?usp=drive_link","tags":["exploit"]},{"url":"https://dl.wavlink.com/firmware/RD/WN530BE2_WAVLINK-WO-2026-09-24-841a51c6d5_tclinux.bin","tags":["patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110958"},{"url":"https://github.com/advisories/GHSA-456r-r3m7-3f5f"}],"sources":{"cve":[{"id":"CVE-2026-110958","title":"Wavlink WN530HG4B api.cgi heap-based overflow","description":"A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: \"We confirm the finding, and it has already been addressed. In the current firmware the api=info\u0026client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked.\"","status":"published","published":"2026-10-15T15:30:18.031Z","modified":"2026-10-15T18:34:20.35Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","level":"critical","assessor":"cna"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"critical","assessor":"cna"},{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C","level":"critical","assessor":"cna"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C","assessor":"cna"}],"cwes":["CWE-122","CWE-119"],"updated_at":"2026-11-02T13:34:26.24368Z"}],"euvd":[{"id":"EUVD-2026-102150","description":"A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: \"We confirm the finding, and it has already been addressed. In the current firmware the api=info\u0026client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked.\"","status":"published","published":"2026-10-15T15:30:18Z","modified":"2026-10-15T18:34:20Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P","level":"critical"}],"updated_at":"2026-11-02T17:00:10.766559Z"}],"ghsa":[{"id":"GHSA-456r-r3m7-3f5f","title":"A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an...","description":"A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: \"We confirm the finding, and it has already been addressed. In the current firmware the api=info\u0026client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked.\"","status":"published","published":"2026-10-15T18:32:37Z","modified":"2026-10-15T18:32:43Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:13:36.44286Z"}],"nvd":[{"id":"CVE-2026-110958","description":"A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: \"We confirm the finding, and it has already been addressed. In the current firmware the api=info\u0026client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked.\"","status":"published","published":"2026-10-15T16:17:48.467Z","modified":"2026-10-15T19:56:13.35Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"secondary"}],"cwes":["CWE-119","CWE-122"],"updated_at":"2026-11-02T14:12:59.751798Z"}]}}