Remote Heap-Based Buffer Overflow in Wavlink WN530HG4B

A critical vulnerability (CVE-2026-110958) has been identified in the Wavlink WN530HG4B router, specifically within the firmware version M30HG4B_V260724. The vulnerability manifests in the api.cgi handler, where insecure processing of the api=info&client=app request leads to a heap-based buffer overflow. Historically, the firmware utilized the system() function to process these requests, creating a pathway for command injection and memory corruption.

The vendor has acknowledged the flaw and issued a firmware update (2026-09-24-841a51c6d5_tclinux.bin) to remediate the issue. The patch transitions the login script execution from system() to execvp and introduces strict length-limiting and null-checking for client address inputs. Public exploit code for this vulnerability is available, posing a high risk to unpatched devices exposed to the internet. Defenders should prioritize firmware upgrades and isolate vulnerable management interfaces from public networks.

Impact

Successful exploitation of CVE-2026-110958 allows unauthenticated remote attackers to trigger a heap-based buffer overflow. This can result in arbitrary code execution on the affected network device. Given the device's role as a network router, successful exploitation grants the attacker persistent control over the network gateway, enabling traffic interception, lateral movement, or complete device compromise. The CVSS base score of 10.0 reflects the high severity and ease of exploitation for remote, unauthenticated actors.

Recommendation

• Immediately upgrade all Wavlink WN530HG4B devices to firmware version 2026-09-24-841a51c6d5_tclinux.bin.
• Restrict access to the device management interface (api.cgi) to trusted internal subnets or local console access only.
• Monitor network traffic for anomalous HTTP POST or GET requests targeting /api.cgi with abnormally long strings in the 'client' parameter.