Vulnerability · Published Jul 1, 2026 · Assigned by VulnCheck

CVE-2026-58454JAIOTlink C492A-W6 4.8.30.57701411 RCE via /Anyka/config Endpoint

High 7.5

In plain English

A high-severity code injection in C492A-W6 Wi-Fi IP Camera from JAIOTlink. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 42.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that allows authenticated attackers to execute arbitrary shell scripts by writing to the writable persistent JFFS2 storage path and triggering execution through the authenticated HTTP endpoint. Attackers can stage a malicious script in the writable persistent storage and request the config endpoint to invoke it via popen(), achieving persistent remote code execution that survives device reboots.

Affected products (as reported)

Vendor	Product	Versions
JAIOTlink	C492A-W6 Wi-Fi IP Camera	4.8.30.57701411

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Researcher Disclosure technical-description, exploit
JAIOTlink Amazon Store product
https://www.vulncheck.com/advisories/jaiotlink-c492a-w6-rce-via-anyka-config-endpoint third-party-advisory