A heap‑based buffer overflow exists in an undocumented function of the api.cgi file in Wavlink WN530HG4B routers. The overflow allows an attacker to corrupt heap memory and potentially execute arbitrary code, effectively giving remote code execution capabilities. The vulnerability originates from the api=info&client=app handler, which originally built a shell command via system() without proper input validation, a flaw fixed in the latest firmware.

The affected product is the Wavlink WN530HG4B router running firmware version M30HG4B_V260724. The vendor recommends installing firmware 2026-09-24-841a51c6d5_tclinux.bin, which replaces the vulnerable function with a safer execvp call and limits input length.

The CVSS score of 10 indicates a critical risk, while the EPSS score of 1% suggests a low but non‑zero probability of exploitation. Nevertheless, the exploit has been made public, and the vendor notes that the api.cgi endpoint can be abused remotely. The vulnerability is not yet listed in CISA’s KEV catalog, but its high severity and public availability make it a priority for remediation. Attackers can trigger the overflow by sending specially crafted API requests over the network to the router.