The vendor has acknowledged the flaw and issued a firmware update (2026-09-24-841a51c6d5_tclinux.bin) to remediate the issue. The patch transitions the login script execution from system() to execvp and introduces strict length-limiting and null-checking for client address inputs. Public exploit code for this vulnerability is available, posing a high risk to unpatched devices exposed to the internet. Defenders should prioritize firmware upgrades and isolate vulnerable management interfaces from public networks.

Impact

Successful exploitation of CVE-2026-110958 allows unauthenticated remote attackers to trigger a heap-based buffer overflow. This can result in arbitrary code execution on the affected network device. Given the device's role as a network router, successful exploitation grants the attacker persistent control over the network gateway, enabling traffic interception, lateral movement, or complete device compromise. The CVSS base score of 10.0 reflects the high severity and ease of exploitation for remote, unauthenticated actors.

Recommendation

• Immediately upgrade all Wavlink WN530HG4B devices to firmware version 2026-09-24-841a51c6d5_tclinux.bin.
• Restrict access to the device management interface (api.cgi) to trusted internal subnets or local console access only.
• Monitor network traffic for anomalous HTTP POST or GET requests targeting /api.cgi with abnormally long strings in the 'client' parameter.