Which versions of JAIOTlink C492A-W6 are affected by CVE-2026-58454?

Compromised JAIOTlink C492A-W6 camera user credentials enable attackers to establish permanent backdoor access to surveillance infrastructure that persists across device reboots, creating an…

Is there a public PoC exploit available for CVE-2026-58454?

Yes, a public proof-of-concept exploit is available for CVE-2026-58454. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-58454?

24 hours: Audit inventory for all JAIOTlink C492A-W6 cameras and firmware versions; restrict network access to these devices at the firewall level. 7 days: Review authentication logs for suspicious activity; rotate all camera credentials and enforce password policies. 30 days: Deploy network segmentation isolating cameras from critical systems; evaluate replacement with patched products or implement long-term compensating controls.

JAIOTlink C492A-W6 CVE-2026-58454

Q: What is the CVSS score of CVE-2026-58454?

CVE-2026-58454 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41050 HIGH

Code Injection (CWE-94)

2026-07-01 VulnCheck

GHSA-347m-p67j-pvqr

Code Injection RCE C492A W6 Wi Fi Ip Camera

7.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable config endpoint (AV:N) but requires valid low-priv credentials (PR:L) and a non-trivial stage-then-trigger sequence (AC:H); successful exploitation yields full device compromise (C/I/A:H).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 16:51 vuln.today

DescriptionCVE.org

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that allows authenticated attackers to execute arbitrary shell scripts by writing to the writable persistent JFFS2 storage path and triggering execution through the authenticated HTTP endpoint. Attackers can stage a malicious script in the writable persistent storage and request the config endpoint to invoke it via popen(), achieving persistent remote code execution that survives device reboots.

AnalysisAI

Authenticated remote code execution in JAIOTlink C492A-W6 Wi-Fi IP cameras (firmware 4.8.30.57701411) lets a logged-in attacker plant a shell script in writable JFFS2 persistent storage and invoke it via popen() through the authenticated Anyka config HTTP endpoint, yielding reboot-surviving persistent RCE. Publicly available exploit code exists (published by VulnCheck), though there is no confirmed active exploitation in CISA KEV. The CVSS 4.0 score of 7.7 reflects high attack complexity offset by full compromise of confidentiality, integrity, and availability.

Technical ContextAI

The device is an ARM-based embedded IP camera built on the Anyka SoC camera platform, which exposes an HTTP configuration service. The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): the firmware combines a writable persistent JFFS2 flash partition (a journaling flash filesystem that retains data across reboots) with a config endpoint that passes attacker-influenced content to popen(), a libc call that spawns a shell to execute a command string. Because the staged script lives in persistent JFFS2 storage rather than a tmpfs/ramdisk, the injected code survives power cycles. The single affected CPE is cpe:2.3:a:jaiotlink:c492a-w6_wi-fi_ip_camera, i.e. the vendor's own camera firmware/application rather than a third-party library.

RemediationAI

No vendor-released patch or fixed firmware version is identified at time of analysis, so remediation relies on compensating controls. Restrict network access to the camera's HTTP management interface by placing devices on an isolated VLAN and blocking inbound access from untrusted networks and the internet, which removes the AV:N reachability the exploit depends on. Because exploitation requires authentication (PR:L), immediately change any default or reused camera credentials to strong unique passwords, since credential compromise is the gating step. Where operationally acceptable, disable remote/WAN access and any UPnP port-forwarding that exposes the config endpoint, and monitor the device for unexpected writes to persistent storage or anomalous outbound connections that would indicate the staged script executing. Track https://www.vulncheck.com/advisories/jaiotlink-c492a-w6-rce-via-anyka-config-endpoint for a vendor fix; if none materializes for an internet-exposed device, consider replacing the camera. Trade-off: VLAN isolation and disabling remote access may break legitimate remote viewing or mobile-app functionality and require reconfiguring how operators reach the camera.