PT-2026-33435 · Wavlink · Wl-Wn530H4

St4R · Published 2026-04-17 · Updated 2026-04-17 · CVE-2026-6483

NVD

CVSS v2.0

8.3

High

AV:N/AC:L/Au:M/C:C/I:C/A:C

A vulnerability was found in Wavlink WL-WN530H4 20220721. This vulnerability affects the function strcat/snprintf of the file /cgi-bin/internet.cgi. The manipulation results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026.04.16 is able to resolve this issue. Upgrading the affected component is recommended.

Exploit

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-6483

Affected Products

Wl-Wn530H4

References · 7

• 🔥 https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/vuldb_submission_report.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6483 · Security Note
• https://dl.wavlink.com/firmware/RD/root_uImage_WN530H4-A_2026.04.16.bin · Patch
• https://twitter.com/CVEnew/status/2045102582595473841 · Twitter Post
• https://vuldb.com/vuln/358021 · Note
• https://vuldb.com/vuln/358021/cti · Note
• https://vuldb.com/submit/783055 · Note