CVE-2026-6483

Wavlink WL-WN530H4 internet.cgi snprintf os command injection

View on CVE.org
Published Apr 17, 2026 CVSS 4.0 · 8.6 High EPSS 13.6% KEV · Not listed
Description
A vulnerability was found in Wavlink WL-WN530H4 20220721. This vulnerability affects the function strcat/snprintf of the file /cgi-bin/internet.cgi. The manipulation results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026.04.16 is able to resolve this issue. Upgrading the affected component is recommended.

Analysis

AI-generated

Technical impact

The flaw arises from improper use of strcat/snprintf in /cgi-bin/internet.cgi, allowing an attacker to inject arbitrary operating‑system commands into the device’s firmware. The injected commands execute with the privileges of the router, enabling full control over the device and compromising its confidentiality, integrity, and availability. The vulnerability is identified by CWE-77 and CWE-78 for command injection and unsafe command execution.

Affected Systems

Wavlink WL-WN530H4 routers running firmware version 20220721 are affected. All units with this firmware are vulnerable; the issue is fixed in the firmware update released on 2026.04.16.

Risk and Exploitability

With a CVSS score of 8.6, the vulnerability is considered high severity. The EPSS score of 13% indicates a significant likelihood of exploitation, and the public availability of an exploit suggests that exploitation is plausible. The feature can be triggered by remote network traffic to /cgi-bin/internet.cgi, so any router exposed to the internet faces a significant risk. The vulnerability is not listed in CISA KEV, but the high impact and remote attack vector warrant immediate action.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the router firmware to version 2026.04.16.
  • Disable or restrict remote management of /cgi-bin/internet.cgi to trusted internal networks only.
  • Apply firewall or network segmentation rules to block external access to the router’s web interface and limit exposure to the local network.

Generated by OpenCVE AI on October 25, 2026 at 19:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Wavlink wl-wn530h4
Vendors & Products Wavlink wl-wn530h4
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in Wavlink WL-WN530H4 20220721. This vulnerability affects the function strcat/snprintf of the file /cgi-bin/internet.cgi. The manipulation results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026.04.16 is able to resolve this issue. Upgrading the affected component is recommended.
Title Wavlink WL-WN530H4 internet.cgi snprintf os command injection
First Time appeared Wavlink
Wavlink wl-wn530h4 Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:wavlink:wl-wn530h4_firmware:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wl-wn530h4 Firmware
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 7.2, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Apr 17, 2026, 10:53 AM
Reserved
Apr 17, 2026, 5:35 AM

View source JSON

Updated
Apr 17, 2026, 10:53 AM

JSON

Status
Deferred
Published
Apr 17, 2026, 11:16 AM
Modified
Oct 25, 2026, 11:10 PM

View source JSON

No data.

Updated
Oct 25, 2026, 7:30 PM

JSON