Key points
- Wavlink WN530HG4B firmware version M30HG4B_V260724 contains a critical remote heap-based buffer overflow.
- The vendor has released a fix in firmware version 2026-09-24-841a51c6d5_tclinux.bin.
- The vulnerability allows remote attackers to exploit the api.cgi file via a public exploit.
Wavlink has released a firmware update for the WN530HG4B Wi-Fi router to address a critical remote heap-based buffer overflow vulnerability. The flaw, tracked as CVE-2026-110958, affects the specific firmware version M30HG4B_V260724 and allows remote manipulation of the api.cgi file.
What happened
The National Vulnerability Database records CVE-2026-110958 as a critical severity issue with a CVSS score of 10. The vulnerability stems from weaknesses classified as CWE-122 and CWE-119, specifically a heap-based buffer overflow within the api.cgi file. An unknown function in this component fails to properly handle input, enabling remote manipulation.
According to the NVD record, the exploit code for this vulnerability has been made public and could be used by attackers. The affected element is an unknown function within the api.cgi file, which processes requests without adequate bounds checking. This lack of validation allows an attacker to overflow the heap memory remotely.
Wavlink confirms the finding and states it has been addressed in the current firmware. The vendor explains that the api=info&client=app handler no longer builds a shell command. Instead, the login script is now invoked through an argument vector using execvp rather than system(). Additionally, the client address is now length-limited and null-checked to prevent overflow.
Why it matters
Organisations using the Wavlink WN530HG4B router must act quickly because the exploit is public and the severity is critical. Remote manipulation of the api.cgi file poses a significant risk to network security. The previous use of system() for command building created a potential attack surface that the new execvp implementation aims to address.
The transition from system() to execvp changes how the login script is invoked, moving away from shell command construction. This change, combined with strict length limits and null checks on client addresses, is part of the vendor's resolution. Security teams should treat this as a high-priority update due to the ease of remote exploitation and the critical CVSS score.
What happens next
- Identify all WN530HG4B routers running firmware version M30HG4B_V260724.
- Download the updated firmware version 2026-09-24-841a51c6d5_tclinux.bin from Wavlink.
- Schedule maintenance windows to apply the firmware update to affected devices.
- Verify the update was successful and check that the api.cgi handler behaves as expected.
Patch priority
Security operations teams should prioritise updating internet-facing Wavlink WN530HG4B routers immediately due to the remote nature of the exploit. Before applying the firmware update, ensure a complete backup of the current configuration to allow for rollback if the update fails. Test the new firmware version in an isolated lab environment first to verify network stability. If immediate patching is not possible, restrict remote access to the router's management interface and monitor for unusual traffic patterns targeting the api.cgi endpoint.
What to do and how to stay safe: Wavlink
- Audit your network inventory to locate all Wavlink WN530HG4B devices running vulnerable firmware.
- Verify that your current firmware version is not M30HG4B_V260724 by checking the device administration panel.
- Plan to upgrade to version 2026-09-24-841a51c6d5_tclinux.bin as soon as operational constraints allow.
- Monitor network logs for suspicious activity targeting the api.cgi endpoint until all devices are patched.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Wavlink router model is affected by CVE-2026-110958?
The Wavlink WN530HG4B router running firmware version M30HG4B_V260724 is affected by this vulnerability.
Is there a fix available for this vulnerability?
Yes, Wavlink has released a firmware update, version 2026-09-24-841a51c6d5_tclinux.bin, which resolves the issue.
What is the severity rating of CVE-2026-110958?
The National Vulnerability Database rates CVE-2026-110958 as critical with a CVSS score of 10.
