CVE-2026-58452 JAIOTlink C492A-W6 4.8.30.57701411 OS Command Injection via SetMAC Endpoint
Authenticated attackers can execute arbitrary OS commands on JAIOTlink Wi-Fi IP cameras via the SetMAC endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58452?
CVE-2026-58452 is a high-severity command injection vulnerability in JAIOTlink C492A-W6 Wi-Fi IP Camera, published on 1 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by supplying a malicious Wireless parameter to the HTTP PUT NetSDK/Factory SetMAC endpoint. Attackers can craft a string beginning with a valid MAC-like prefix followed by a semicolon and a shell payload, which bypasses partial sscanf() validation and is passed unsanitized into an echo shell command executed through a system() wrapper.
Weakness: CWE-78
Which versions are affected by CVE-2026-58452?
How do I fix CVE-2026-58452?
No fix has been published for CVE-2026-58452 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-58452 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58452 exists.
Sources
Also known as GHSA-j337-868r-326w.