CVE-2026-110958Critical· 10.0▾ AbyssalPoC availableA vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The ex…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 55 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
1 GitHub repo (last check)
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."
WN530HG4B M30HG4B_V260724Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110957Critical· 10.0A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604
CVE-2023-7104Medium· 5.5A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical
CVE-2026-109109Critical· 10.0A vulnerability was detected in Wavlink WL-WN530BE1-A 251117
CVE-2025-11083Medium· 5.3A vulnerability has been found in GNU Binutils 2.45
CVE-2025-11495Low· 3.3A vulnerability was determined in GNU Binutils 2.45
CVE-2026-109110Critical· 10.0A flaw has been found in Wavlink WL-WN592AX6 250422