Wavlink WN530HG4B CVE-2026-110958

Exploitation targets the api.cgi endpoint's api=info&client=app handler, which in the vulnerable firmware (M30HG4B_V260724) passed the client address parameter directly into a system() call with no length limit and no null check - that is the specific precondition. The CVSS vector indicates PR:N (no authentication required to reach the handler). The primary real-world limiting factor is network reachability of the device's HTTP management interface: such SOHO routers typically expose administration only on the LAN by default, so remote exploitation from the Internet requires WAN-side management to be enabled or the attacker to already be on the local/adjacent network. No user interaction is required.

Multiple signals align toward genuine priority for exposed devices. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high impact on both the vulnerable system (VC:H/VI:H/VA:H) and - per the input - subsequent systems (SC:H/SI:H/SA:H), yielding a 9.3 Critical. The vendor's own confirmation is the strongest corroborating signal: it states the vulnerable api=info&client=app handler passed an attacker-controlled client address into system() without length-limiting or null-checking, meaning the 'heap-based buffer overflow' (CWE-122) realistically enabled OS command execution as the web server (typically root on such embedded routers). A public exploit exists (POC=YES), raising practical risk beyond theoretical. Tempering factors and gaps: this is NOT on CISA KEV, so there is no confirmed active exploitation - exploit maturity is only E:P (Proof-of-Concept) in the supplied vector. No EPSS score was provided, so widespread-exploitation probability cannot be quantified. The subsequent-system impacts (SC/SI/SA:H) in the input appear inflated for a base score - compromise is of the router itself; downstream LAN impact is a consequence of pivoting, not an inherent scope change - verify before relying on the 9.3. Net: a real, patch-now issue for any Internet-facing WN530HG4B, but likely targeted/niche rather than mass-exploited given the specific consumer model and absence of KEV/EPSS data.

A remote attacker reachable on the router's web management interface sends a crafted request to api.cgi invoking the api=info&client=app handler with an oversized or shell-metacharacter-laden client address value. Because the firmware passed this unbounded value into system(), the request triggers a heap-based buffer overflow and OS command injection, giving the attacker code execution on the device. A working proof-of-concept is publicly hosted (Google Drive), lowering the barrier to reproduction.