Wn530Hg4B
Monthly
A heap-based buffer overflow in the api.cgi management handler of Wavlink WN530HG4B routers (firmware M30HG4B_V260724) allows unauthenticated remote attackers to corrupt heap memory by sending a crafted request to the api=info&client=app endpoint. The vulnerability is rated 9.3 under CVSS 4.0 (assessed 9.8 under CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting no authentication requirement, no user interaction, and full loss of confidentiality, integrity, and availability on the affected device. Publicly available exploit code exists, and while the issue is not confirmed as actively exploited (not in CISA KEV), the weaponizable nature of an unbounded parameter flowing into a shell-invoked handler makes patching exposed devices a priority; the vendor has released firmware 2026-09-24-841a51c6d5_tclinux.bin that resolves the flaw.
A heap-based buffer overflow in the api.cgi management handler of Wavlink WN530HG4B routers (firmware M30HG4B_V260724) allows unauthenticated remote attackers to corrupt heap memory by sending a crafted request to the api=info&client=app endpoint. The vulnerability is rated 9.3 under CVSS 4.0 (assessed 9.8 under CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting no authentication requirement, no user interaction, and full loss of confidentiality, integrity, and availability on the affected device. Publicly available exploit code exists, and while the issue is not confirmed as actively exploited (not in CISA KEV), the weaponizable nature of an unbounded parameter flowing into a shell-invoked handler makes patching exposed devices a priority; the vendor has released firmware 2026-09-24-841a51c6d5_tclinux.bin that resolves the flaw.