How does Wavlink's api.cgi heap overflow fix resolve CVE-2026-110958?

The short version

• The flaw allows remote attackers to trigger a heap-based buffer overflow.
• The exploit code has been made publicly available for use.
• Upgrading to the latest firmware resolves the confirmed vulnerability.

The details

A critical vulnerability has been identified in Wavlink WN530HG4B routers running firmware version M30HG4B_V260724. According to the NVD record, the issue is CVE-2026-110958, which carries a CVSS score of 10. The weakness stems from a heap-based buffer overflow within the api.cgi file. Attackers can launch this exploit remotely, and the code required to do so has been published. Wavlink has confirmed the finding and stated that the issue is already addressed in newer releases. The vendor advises upgrading to version 2026-09-24-841a51c6d5_tclinux.bin to resolve the risk.

The context

The vulnerability involves weaknesses classified as CWE-122 and CWE-119. Wavlink explained that the previous firmware version used the system() function to build shell commands for the api=info&client=app handler. In the patched firmware, this handler no longer constructs shell commands. Instead, the login script is invoked through an argument vector using execvp. Additionally, the vendor implemented length limitations and null-checks for client addresses to prevent the overflow.

Next steps

Administrators should verify if their WN530HG4B devices are running the vulnerable M30HG4B_V260724 firmware. If so, they must apply the update to version 2026-09-24-841a51c6d5_tclinux.bin. This update is described as sufficient to resolve the issue. Teams should ensure the upgrade process completes successfully and validate that the new firmware is active on all affected routers.

What defenders should look for

Security operations teams should monitor for unusual traffic patterns targeting the api.cgi endpoint on Wavlink devices. Look for spikes in connection attempts from unknown sources or repeated requests to the api=info handler. Check firewall logs for blocked attempts to access this specific URL parameter. Investigate any router reboots or instability that correlates with these access logs. Containment usually involves isolating affected devices from the network until patched. Teams should also review DNS logs for any potential command-and-control traffic originating from these compromised endpoints.

What to do and how to stay safe: Wavlink

• Audit your network inventory to identify all Wavlink WN530HG4B routers.
• Check the current firmware version against the vulnerable M30HG4B_V260724 identifier.
• Apply the vendor-provided firmware update 2026-09-24-841a51c6d5_tclinux.bin immediately.
• Monitor network logs for exploitation attempts targeting the api.cgi component.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Wavlink router model is affected by CVE-2026-110958?

The Wavlink WN530HG4B router running firmware version M30HG4B_V260724 is affected.

Is the exploit for this vulnerability publicly available?

Yes, the exploit has been made public and could be used by attackers.

What firmware version fixes the heap overflow issue?

Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to resolve the issue.