PT-2026-54916 · Jaiotlink · Jaiotlink C492A-W6

Andres Valdes · Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-58454

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JAIOTlink C492A-W6 version 4.8.30.57701411

Description Authenticated attackers can achieve persistent remote code execution by writing arbitrary shell scripts to the writable persistent JFFS2 storage path. The execution is triggered through an authenticated HTTP endpoint that invokes the script via the popen() function. This allows the malicious script to persist even after the device is rebooted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-58454

Affected Products

Jaiotlink C492A-W6

References · 5

• 🔥 https://github.com/rwprimitives/jaiotlink-c492a-wifi-camera/blob/main/writeups/03-anyka-config-execution-trigger.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-58454 · Security Note
• https://twitter.com/VulmonFeeds/status/2072388724655075442 · Twitter Post
• https://amazon.com/stores/JAIOTlink/page/3B00DC41-70C3-4BAA-925C-3D222C2633D5?lp_asin=B0GX1BNZ78&ref_=ast_bln&store_ref=bl_ast_dp_brandlogo_sto · Note
• https://vulncheck.com/advisories/jaiotlink-c492a-w6-rce-via-anyka-config-endpoint · Note