The flaw arises from improper use of strcat/snprintf in /cgi-bin/internet.cgi, allowing an attacker to inject arbitrary operating‑system commands into the device’s firmware. The injected commands execute with the privileges of the router, enabling full control over the device and compromising its confidentiality, integrity, and availability. The vulnerability is identified by CWE‑77 and CWE‑78 for command injection and unsafe command execution.

Wavlink WL-WN530H4 routers running firmware version 20220721 are affected. All units with this firmware are vulnerable; the issue is fixed in the firmware update released on 2026.04.16.

With a CVSS score of 8.6, the vulnerability is considered high severity. Although EPSS data is not available, the public availability of an exploit suggests that exploitation is plausible. The feature can be triggered by remote network traffic to /cgi-bin/internet.cgi, so any router exposed to the internet faces a significant risk. The vulnerability is not listed in CISA KEV, but the high impact and remote attack vector warrant immediate action.