Wavlink

Records249All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical135CVSS 9.0–10.0

CVSS high49CVSS 7.0–8.9

Exploited now

Wavlink records in CISA KEV

No Wavlink vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wl-wn533a8 Firmware 63 records HIGH Wl-nu516u1 Firmware 28 records HIGH Wn530h4 Firmware 27 records HIGH Wn535g3 Firmware 23 records HIGH Wn533a8 Firmware 20 records HIGH Wn531p3 Firmware 17 records HIGH Wn572hp3 Firmware 16 records HIGH Wl-wn578w2 Firmware 9 records HIGH

Records

249 records

TI-2022-02298 CVE-2022-2487 · GHSA-gv4v-6v97-75hc

WAVLINK WN535K2/WN535K3 nightled.cgi os command injection

HIGH 83

A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.79304 Published 2022-07-20 No fix listed CWE-78

TI-2026-83752 CVE-2026-120345 · GHSA-5m3x-rp28-cf8g

OS command injection in WAVLINK WN551X3-A DNS resolution handler

HIGH 82

A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.01989 Published 2026-11-02 No fix listed CWE-77

TI-2026-83751 CVE-2026-120344 · GHSA-fqxg-jwfx-25cg

WAVLINK WN551X3-A WireGuard CLI Group ioos os command injection

HIGH 82

A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.01989 Published 2026-11-02 No fix listed CWE-77

TI-2026-83668 CVE-2026-120281 · GHSA-rg96-pw5p-hj64

Stack-based overflow in WAVLINK WN536AX6-A OpenVPN handler

HIGH 82

A vulnerability was found in WAVLINK WN536AX6-A V260507.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00584 Published 2026-11-02 No fix listed CWE-119

TI-2026-83667 CVE-2026-120280 · GHSA-q3mh-mrr2-xh2h

OS command injection in WAVLINK WN536AX6-A WireGuard handler

HIGH 82

A vulnerability has been found in WAVLINK WN536AX6-A V260507.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.01989 Published 2026-11-02 No fix listed CWE-77

TI-2026-83666 CVE-2026-120279 · GHSA-x3j2-x298-hcr4

OS command injection in WAVLINK WN536AX6-A openvpn_cli handler

HIGH 82

A flaw has been found in WAVLINK WN536AX6-A V260507.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.01989 Published 2026-11-02 No fix listed CWE-77

TI-2026-83664 CVE-2026-120277 · GHSA-f5q6-27px-wgxf

WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 OS command injection

HIGH 82

A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.02451 Published 2026-11-01 No fix listed CWE-77

TI-2026-83663 CVE-2026-120276 · GHSA-jxgh-x37p-hq3v

OS command injection in WAVLINK WN536AX6-A web management interface

HIGH 82

A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.03211 Published 2026-11-01 No fix listed CWE-77

TI-2026-83583 CVE-2026-120198 · GHSA-cq8m-m2p5-jxxm

Command injection in WAVLINK WL-WN530BE1-A via protocol.csp

HIGH 82

A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.0207 Published 2026-11-01 No fix listed CWE-74

TI-2026-83580 CVE-2026-120195 · GHSA-3wx6-ffgj-fwjg

OS command injection in WAVLINK WL-WN579A3-A Initial Setup Wizard

HIGH 82

A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.0207 Published 2026-11-01 No fix listed CWE-77

TI-2026-74806 CVE-2026-110958

Heap-based buffer overflow in Wavlink WN530HG4B api.cgi

HIGH 82

A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.0102 Published 2026-10-15 Fixed in 2026-09-24-841a51c6d5_tclinux.bin CWE-119

TI-2026-74783 CVE-2026-110957

OS command injection in Wavlink WL-WN530BE2-A login processing

HIGH 82

A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.03066 Published 2026-10-15 Fixed in 2026-09-24-841a51c6d5_tclinux.bin CWE-77

TI-2026-71564 CVE-2026-109110 · GHSA-6fjw-pj9v-fhcm

OS command injection in Wavlink WL-WN592AX6 wmapd daemon

HIGH 82

A flaw has been found in Wavlink WL-WN592AX6 250422.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.02028 Published 2026-10-13 No fix listed CWE-77

TI-2025-28673 CVE-2025-44868 · GHSA-38h7-w62h-qf32

Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the…

HIGH 82

Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.cgi via the pingIp parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02655 Published 2025-05-02 No fix listed CWE-77

TI-2024-36652 CVE-2024-54747 · GHSA-wc2c-7p6r-2qq8

WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in…

HIGH 82

WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00559 Published 2024-12-06 No fix listed CWE-276

TI-2024-36651 CVE-2024-54745 · GHSA-rhph-9qcj-jrgq

WAVLINK WN701AE M01AE_V240305 was discovered to contain a hardcoded password…

HIGH 82

WAVLINK WN701AE M01AE_V240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00559 Published 2024-12-06 No fix listed CWE-276

TI-2023-20137 CVE-2023-38861 · GHSA-37xx-6pm7-9879

An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute…

HIGH 82

An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via username parameter of the set_sys_adm function in adm.cgi.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01642 Published 2023-08-15 No fix listed CWE-77

TI-2026-76993 CVE-2026-113802 · GHSA-j6fh-9747-5rv9

OS command injection in Wavlink WL-WN530BE1-A firmware

HIGH 81

Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.03472 Published 2026-10-20 No fix listed CWE-78

TI-2026-60326 CVE-2026-89010 · GHSA-22gq-jjvp-2jc9

WAVLINK WN535M1/WN535M3 Unauthenticated OS Command Injection via sync_server

HIGH 81

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending craf…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.03168 Published 2026-09-11 Fixed in M35M1_V250922 CWE-78

TI-2026-15233 CVE-2026-18588 · GHSA-hfj9-7vrj-jwv3

Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow

HIGH 81

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01096 Published 2026-08-03 No fix listed CWE-119

TI-2026-03611 CVE-2026-4163 · GHSA-pgmv-83cp-gpc7

Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection

HIGH 81

A vulnerability was detected in Wavlink WL-WN579A3 220323.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.02187 Published 2026-03-14 No fix listed CWE-74

TI-2026-03195 CVE-2026-3703 · GHSA-6rfc-r3c7-7f5j

Wavlink NU516U1 login.cgi sub_401A10 out-of-bounds write

HIGH 81

A flaw has been found in Wavlink NU516U1 251208.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00929 Published 2026-03-08 No fix listed CWE-119

TI-2020-09757 CVE-2020-12124 · GHSA-qjcv-q7cx-q8cc

A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of…

HIGH 81

A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.7465 Published 2020-10-02 No fix listed CWE-78

TI-2020-10310 CVE-2020-13117 · GHSA-377v-3m99-jhrj

Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated…

HIGH 79

Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.68576 Published 2021-02-09 No fix listed CWE-77

TI-2026-60325 CVE-2026-89009 · GHSA-pg3c-cqw3-4pgg

WAVLINK WN535M1/WN535M3 Unauthenticated Arbitrary File Write via sync_server

HIGH 77

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a craf…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.01011 Published 2026-09-11 Fixed in M35M1_V250922 CWE-36

Open these records in search →

Critical	135
High	49
Medium	65
Low	0
No CVSS	0