# CVE-2026-58454: JAIOTlink C492A-W6 remote code execution in Anyka config endpoint

Source: https://junglewise.ai/threats/cve-2026-58454-jaiotlink-c492a-w6-remote-code-execution-in-anyka-config-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-58454 · Severity: high · CVSS 7.5 · Published 2026-07-01

JAIOTlink Wi-Fi IP cameras, used for remote video monitoring, contain a security flaw that allows an authorized user to take full control of the device. By uploading a malicious script to the camera's internal storage, an attacker can force the device to execute that script. This results in a permanent compromise of the camera that remains active even after the device is restarted, potentially allowing unauthorized access to video feeds or the local network.

Technologies: [JAIOTlink C492A-W6 Wi-Fi IP Camera](https://junglewise.ai/threats/technologies/c492a-w6-wi-fi-ip-camera). Vendors: [JAIOTlink](https://junglewise.ai/threats/vendors/jaiotlink).

## Quick answers

**Is CVE-2026-58454 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58454 being exploited in the wild.

**How severe is CVE-2026-58454?** High severity, with a CVSS score of 7.5, published 1 July 2026.

**Which products and versions are affected?** JAIOTlink C492A-W6 Wi-Fi IP Camera 4.8.30.57701411.

**Is there a fix for CVE-2026-58454?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-58454 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-58454?** Check whether you run JAIOTlink C492A-W6 Wi-Fi IP Camera at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A remote code execution vulnerability exists in JAIOTlink C492A-W6 Wi-Fi IP cameras due to improper control of code generation (CWE-94). An authenticated attacker can exploit this by writing a malicious shell script to the writable persistent JFFS2 storage path. The attacker then triggers the execution of this script by sending a request to the authenticated /Anyka/config HTTP endpoint, which invokes the script via the popen() function. This flaw allows for persistent remote code execution that survives device reboots. The attack requires network access and valid user credentials, though it is classified as high complexity due to the multi-step staging process.

## Affected products

- JAIOTlink C492A-W6 Wi-Fi IP Camera 4.8.30.57701411

## Timeline

- 2026-07-01: advisory: Vulnerability disclosed by VulnCheck and NVD

## References

- [https://github.com/rwprimitives/jaiotlink-c492a-wifi-camera/blob/main/writeups/03-anyka-config-execution-trigger.md](https://github.com/rwprimitives/jaiotlink-c492a-wifi-camera/blob/main/writeups/03-anyka-config-execution-trigger.md)
- [https://www.amazon.com/stores/JAIOTlink/page/3B00DC41-70C3-4BAA-925C-3D222C2633D5?lp_asin=B0GX1BNZ78&ref_=ast_bln&store_ref=bl_ast_dp_brandlogo_sto](https://www.amazon.com/stores/JAIOTlink/page/3B00DC41-70C3-4BAA-925C-3D222C2633D5?lp_asin=B0GX1BNZ78&ref_=ast_bln&store_ref=bl_ast_dp_brandlogo_sto)
- [https://www.vulncheck.com/advisories/jaiotlink-c492a-w6-rce-via-anyka-config-endpoint](https://www.vulncheck.com/advisories/jaiotlink-c492a-w6-rce-via-anyka-config-endpoint)

## Related threats

- [JAIOTlink C492A-W6 hard-coded credentials in anyka_ipc service](https://junglewise.ai/threats/cve-2026-58453-jaiotlink-c492a-w6-hard-coded-credentials-in-anyka-ipc-service)
- [JAIOTlink C492A-W6 OS command injection in SetMAC endpoint](https://junglewise.ai/threats/cve-2026-58452-jaiotlink-c492a-w6-os-command-injection-in-setmac-endpoint)