CVE-2026-6483

HIGH 7.2

Wavlink WL-WN530H4 internet.cgi snprintf os command injection

CVSS Score

7.2

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in Wavlink WL-WN530H4 20220721. This vulnerability affects the function strcat/snprintf of the file /cgi-bin/internet.cgi. The manipulation results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026.04.16 is able to resolve this issue. Upgrading the affected component is recommended.

CWE	CWE-78 CWE-77
Vendor	wavlink
Product	wl-wn530h4
Published	Apr 17, 2026
Last Updated	Apr 17, 2026

Stay Ahead of the Next One

Get instant alerts for wavlink wl-wn530h4

Be the first to know when new high vulnerabilities affecting wavlink wl-wn530h4 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Wavlink / WL-WN530H4

20220721

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/358021 vuldb.com: https://vuldb.com/vuln/358021/cti vuldb.com: https://vuldb.com/submit/783055 github.com: https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/vuldb_submission_report.md dl.wavlink.com: https://dl.wavlink.com/firmware/RD/root_uImage_WN530H4-A_2026.04.16.bin

Credits

🔍 ST4R (VulDB User)