CVE-2026-110958 Wavlink WN530HG4B api.cgi heap-based overflow
Remote attackers can exploit a heap-based buffer overflow in the api.cgi component of Wavlink routers to execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110958?
CVE-2026-110958 is a critical memory corruption vulnerability in Wavlink WN530HG4B, published on 15 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."
Which versions are affected by CVE-2026-110958?
How do I fix CVE-2026-110958?
No fix has been published for CVE-2026-110958 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-110958 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-110958 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-456r-r3m7-3f5f.