Wavlink patches critical remote heap overflow in WN530HG4B Wi-Fi router firmware

Wavlink has released a firmware update to address a critical vulnerability in its WN530HG4B Wi-Fi router. The flaw, tracked as CVE-2026-110958, allows remote attacks via a heap-based buffer overflow, according to the National Vulnerability Database.

The vulnerability stems from a heap-based buffer overflow in the api.cgi file. Attackers can trigger this by manipulating the api=info&client=app handler. The National Vulnerability Database records the severity as CVSS 10 Critical.

Technical Details of the Vulnerability

The affected component is an unknown function within the api.cgi file of the Wavlink WN530HG4B running firmware version M30HG4B_V260724. The weakness is categorized under CWE-122 (Heap-based Buffer Overflow) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer).

According to the National Vulnerability Database, the exploit code for this vulnerability has been made public. This means that threat actors can potentially use the available code to launch attacks against unpatched devices. The remote nature of the attack vector allows adversaries to target devices from outside the local network.

Vendor Response and Mitigation

Wavlink has confirmed the finding and stated that the issue has been addressed in a new firmware release. The company advises users to upgrade to version 2026-09-24-841a51c6d5_tclinux.bin to resolve the security issue.

In a statement regarding the fix, Wavlink explained that the api=info&client=app handler no longer builds a shell command. Instead, the login script is now invoked through an argument vector using execvp rather than system(). Additionally, the client address is now length-limited and null-checked to prevent buffer overflows.

Affected Devices and Scope

Only the Wavlink WN530HG4B router running firmware version M30HG4B_V260724 is affected by this specific vulnerability. Other Wavlink models or different firmware versions are not listed in the National Vulnerability Database record for CVE-2026-110958.

Users of this specific router model should verify their current firmware version immediately. If the device is running the vulnerable version, it is susceptible to remote exploitation until the patch is applied. The public availability of the exploit code increases the urgency for administrators to deploy the fix.

What should you do?

Administrators and users should check the firmware version of their Wavlink WN530HG4B routers. If the device is running M30HG4B_V260724, they should download and install the latest firmware update provided by the vendor. Until the update is applied, consider isolating the device from the internet if possible.