Which versions of JAIOTlink C492A-W6 are affected by CVE-2026-58452?

JAIOTlink C492A-W6 Wi-Fi IP cameras (firmware 4.8.30.57701411) contain an authenticated remote code execution vulnerability (CVSS 8.7) exploitable by any authenticated user to execute arbitrary OS…

Is there a public PoC exploit available for CVE-2026-58452?

Yes, a public proof-of-concept exploit is available for CVE-2026-58452. Prioritise patching immediately. EPSS: 2.4%.

How to fix or mitigate CVE-2026-58452?

Within 24 hours: Inventory all JAIOTlink C492A-W6 cameras running firmware 4.8.30.57701411; review access logs for suspicious activity on the NetSDK/Factory endpoint. Within 7 days: Isolate affected cameras on a dedicated VLAN with firewall rules restricting access to known management interfaces; disable the vulnerable endpoint if operationally feasible. Within 30 days: Request patched firmware from JAIOTlink; if unavailable by end of month, initiate replacement evaluation with vendors providing active security updates.

JAIOTlink C492A-W6 CVE-2026-58452

Q: What is the CVSS score of CVE-2026-58452?

CVE-2026-58452 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.4%.

EUVD-2026-41048 HIGH

OS Command Injection (CWE-78)

2026-07-01 VulnCheck

GHSA-j337-868r-326w

Command Injection RCE C492A W6 Wi Fi Ip Camera

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable HTTP endpoint (AV:N) with straightforward injection (AC:L) but requires low-privilege authentication (PR:L); command execution yields full device compromise, so C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:50 vuln.today

DescriptionCVE.org

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by supplying a malicious Wireless parameter to the HTTP PUT NetSDK/Factory SetMAC endpoint. Attackers can craft a string beginning with a valid MAC-like prefix followed by a semicolon and a shell payload, which bypasses partial sscanf() validation and is passed unsanitized into an echo shell command executed through a system() wrapper.

AnalysisAI

Authenticated remote code execution in JAIOTlink C492A-W6 Wi-Fi IP cameras (firmware 4.8.30.57701411) lets a logged-in attacker run arbitrary OS commands via the HTTP PUT NetSDK/Factory SetMAC endpoint. The Wireless parameter is only partially validated by sscanf(), so a value shaped as a valid MAC prefix followed by a semicolon and shell payload survives validation and is passed unsanitized into an echo command run through system(). Publicly available exploit code exists (VulnCheck), and CVSS 4.0 rates it 8.7 (High); no public exploit identified in CISA KEV, so this is not confirmed actively exploited.

Technical ContextAI

The flaw is a classic CWE-78 OS Command Injection in the camera's NetSDK/Factory web service, specifically the SetMAC handler that writes wireless/MAC configuration. The affected product per CPE is cpe:2.3:a:jaiotlink:c492a-w6_wi-fi_ip_camera. The root cause is trusting sscanf() as an input filter: sscanf() only parses the leading MAC-like prefix and returns success, but the remainder of the string (a ';' plus attacker shell commands) is never stripped. That full string is then concatenated into an 'echo' command string and handed to system(), which invokes a shell that honors the ';' command separator. This is the standard danger of building shell command lines from network input rather than using argument-safe exec APIs or strict allowlist validation of the entire input.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data, so remediation must rely on compensating controls. Because exploitation requires authentication to the camera's HTTP interface, first change all default and weak camera credentials and enforce strong unique passwords, which directly removes the low-privilege foothold the exploit needs. Isolate the cameras on a dedicated management VLAN and block their web/NetSDK ports from untrusted networks and the internet, permitting access only from a trusted management host or VPN - this prevents remote reach to the vulnerable PUT NetSDK/Factory SetMAC endpoint at the cost of requiring a jump host for administration. Where feasible, restrict or filter access to the SetMAC/Factory endpoints via an upstream reverse proxy or firewall rule; note this may break legitimate factory/provisioning workflows. Monitor for JAIOTlink firmware updates addressing this issue and consult the VulnCheck advisory (https://www.vulncheck.com/advisories/jaiotlink-c492a-w6-os-command-injection-via-setmac-endpoint) for fixed-version guidance.