Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

WAVLINK — Vulnerabilities & Security Advisories 165

Browse all 165 CVE security advisories affecting WAVLINK. AI-powered Chinese analysis, POCs, and references for each vulnerability.

WAVLINK operates primarily as a manufacturer of consumer networking hardware, specializing in Wi-Fi routers, range extenders, and USB adapters for home and small office environments. Security audits have identified a significant volume of vulnerabilities within its firmware ecosystem, with 119 Common Vulnerabilities and Exposures currently recorded. These flaws predominantly involve remote code execution, cross-site scripting, and privilege escalation issues, often stemming from inadequate input validation and weak authentication mechanisms in web management interfaces. While the company has not been the subject of a singular, widely publicized catastrophic breach comparable to major IoT botnets, the sheer number of disclosed CVEs indicates systemic weaknesses in its secure development lifecycle. Many of these vulnerabilities allow unauthenticated attackers to gain administrative control or execute arbitrary commands, posing substantial risks to user privacy and network integrity.

CVE ID Title CVSS Severity Published
CVE-2026-120345 WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection — WN551X3-A CWE-78 10.0 Critical 2026-11-02
CVE-2026-120344 WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection — WN551X3-A CWE-78 10.0 Critical 2026-11-02
CVE-2026-120282 WAVLINK WN536AX6-A protocol.csp host_black os command injection — WN536AX6-A CWE-78 9.9 Critical 2026-11-02
CVE-2026-120281 WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow — WN536AX6-A CWE-121 10.0 Critical 2026-11-02
CVE-2026-120280 WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection — WN536AX6-A CWE-78 10.0 Critical 2026-11-02
CVE-2026-120279 WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection — WN536AX6-A CWE-78 10.0 Critical 2026-11-02
CVE-2026-120278 WAVLINK WN536AX6-A VPN Client List ioos sub_41a7c0 missing authentication — WN536AX6-A CWE-306 5.3 Medium 2026-11-01
CVE-2026-120277 WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection — WN536AX6-A CWE-78 10.0 Critical 2026-11-01
CVE-2026-120276 WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection — WN536AX6-A CWE-78 10.0 Critical 2026-11-01
CVE-2026-120240 WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection — WN553X1-B CWE-78 9.9 Critical 2026-11-01
CVE-2026-120239 WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection — WN553X1-B CWE-78 9.9 Critical 2026-11-01
CVE-2026-120238 WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection — WN553X1-B CWE-78 9.9 Critical 2026-11-01
CVE-2026-120231 WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection — WN553X1-B CWE-78 9.9 Critical 2026-11-01
CVE-2026-120230 WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection — WN701AE CWE-78 9.9 Critical 2026-11-01
CVE-2026-120229 WAVLINK WN553X1-B ioos sub_416B50 os command injection — WN553X1-B CWE-78 9.1 Critical 2026-11-01
CVE-2026-120228 WAVLINK WN553X1-B ioos Service sub_416D88 os command injection — WN553X1-B CWE-78 9.9 Critical 2026-11-01
CVE-2026-120227 WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection — WN701AE CWE-78 9.9 Critical 2026-11-01
CVE-2026-120198 WAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection — WL-WN530BE1-A CWE-77 10.0 Critical 2026-11-01
CVE-2026-120197 WAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection — WL-WN530HG4B CWE-78 9.9 Critical 2026-11-01
CVE-2026-120196 WAVLINK WN579X3-D wapi.cgi port_forward os command injection — WN579X3-D CWE-78 9.9 Critical 2026-11-01
CVE-2026-120195 WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set_wzdgwMesh os command injection — WL-WN579A3-A CWE-78 10.0 Critical 2026-11-01
CVE-2026-113802 Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler — WL-WN530BE1-A CWE-78 9.8 Critical 2026-10-20
CVE-2026-110958 Wavlink WN530HG4B api.cgi heap-based overflow — WN530HG4B CWE-122 10.0 Critical 2026-10-15
CVE-2026-110957 Wavlink WL-WN530BE2-A Login Processing api.cgi sub_12580 os command injection — WL-WN530BE2-A CWE-78 10.0 Critical 2026-10-15
CVE-2026-109110 Wavlink WL-WN592AX6 wmapd system os command injection — WL-WN592AX6 CWE-78 10.0 Critical 2026-10-13
CVE-2026-109109 Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow — WL-WN530BE1-A CWE-121 10.0 Critical 2026-10-13
CVE-2026-109108 Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection — WL-WN530BE1-A CWE-78 9.9 Critical 2026-10-13
CVE-2026-109107 Wavlink WL-WN592AX6 upload.cgi main null pointer dereference — WL-WN592AX6 CWE-476 6.5 Medium 2026-10-13
CVE-2026-74843 Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow — WN531P3 CWE-121 10.0 Critical 2026-08-17
CVE-2026-18607 Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow — WN572 CWE-121 8.8 High 2026-08-03

This page lists every published CVE security advisory associated with WAVLINK. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.