PT-2026-54914 · Unknown · Jaiotlink C492A-W6

Andres Valdes + 1 · Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-58452

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JAIOTlink C492A-W6 version 4.8.30.57701411

Description An OS command injection flaw exists where authenticated attackers can achieve remote code execution. By sending a malicious string to the 'NetSDK/Factory SetMAC' HTTP PUT endpoint, an attacker can bypass partial sscanf() validation. The attack involves providing a Wireless parameter starting with a valid MAC-like prefix followed by a semicolon and a shell payload, which is then passed unsanitized into an echo shell command executed via a system() wrapper.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the Wireless parameter in the 'NetSDK/Factory SetMAC' endpoint until the issue is resolved.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-58452

Affected Products

Jaiotlink C492A-W6

References · 5

• 🔥 https://github.com/rwprimitives/jaiotlink-c492a-wifi-camera/blob/main/writeups/01-setmac-command-injection.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-58452 · Security Note
• https://amazon.com/stores/JAIOTlink/page/3B00DC41-70C3-4BAA-925C-3D222C2633D5?lp_asin=B0GX1BNZ78&ref_=ast_bln&store_ref=bl_ast_dp_brandlogo_sto · Note
• https://vulncheck.com/advisories/jaiotlink-c492a-w6-os-command-injection-via-setmac-endpoint · Note
• https://twitter.com/VulmonFeeds/status/2072386164644802922 · Twitter Post