CVE-2026-110958: the affected product Memory Buffer Errors (CVSS 9.3)

CVE-2026-110958 affects the affected product. Before acting, confirm where the affected product runs in your estate, who owns it and whether it is reachable from the internet, because exposure decides real risk more than the score alone.

In plain terms: A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."

The weakness class is Memory Buffer Errors. The program reads or writes outside the memory it should.

Based on its CVSS vector, the flaw can be reached over the network, needs no login, and needs no user interaction. Apply the vendor fix and confirm exposure on internet facing and business critical assets first.