WAVLINK has 36 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 24 in the last 90 days against 4 in the 90 before. The busiest recent month was November 2026 with 17. The median CVSS is 9.9 (critical), with 22 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-77 (29) and CWE-78 (22). Most affected products: wl-nu516u1_firmware (11), WN536AX6-A (5), WN553X1-B (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.9
- Publish → KEV
- —
- Last 90 days
- 24 prev 4
Products
- wl-nu516u1_firmware 11
- WN536AX6-A 5
- WN553X1-B 5
- WL-WN530BE1-A 4
- WL-WN592AX6 2
- WN551X3-A 2
Worst active — by depth score
CVE-2026-110957Critical· 10.0A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V25060468CVE-2026-120344Critical· 10.0WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection67CVE-2026-120282Critical· 9.9WAVLINK WN536AX6-A protocol.csp host_black os command injection67CVE-2026-120279Critical· 10.0WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection67CVE-2026-120240Critical· 9.9WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection67
WAVLINK vulnerabilities
CVEs affecting WAVLINK, newest first. Open any entry for full detail, references, and exploit status.
36 CVEsRSS
CVE-2026-120282Critical· 9.9PoCWAVLINK WN536AX6-A protocol.csp host_black os command injection
A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possibl…
CVE-2026-120279Critical· 10.0PoCWAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection
A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command inje…
CVE-2026-120344Critical· 10.0PoCWAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os c…
CVE-2026-120345Critical· 10.0WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection
A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os com…
CVE-2026-120281Critical· 10.0WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow
A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The…
CVE-2026-120197Critical· 9.9PoCWAVLINK WL-WN530HG4B wapi.cgi port_forward os command injection
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remo…
CVE-2026-120239Critical· 9.9PoCWAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in o…
CVE-2026-120231Critical· 9.9PoCWAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command in…
CVE-2026-120227Critical· 9.9PoCWAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection
A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in…
CVE-2026-120278Medium· 5.3PoCWAVLINK WN536AX6-A VPN Client List ioos sub_41a7c0 missing authentication
A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. Impacted is the function sub_416d48/sub_41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in mis…
CVE-2026-120240Critical· 9.9PoCWAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_nam…
CVE-2026-120228Critical· 9.9PoCWAVLINK WN553X1-B ioos Service sub_416D88 os command injection
A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os…
CVE-2026-120198Critical· 10.0PoCWAVLINK WL-WN530BE1-A protocol.csp con_check_read_finish command injection
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to command injection. It is possible to…
CVE-2026-120277Critical· 10.0WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection
A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name l…
CVE-2026-120238Critical· 9.9WAVLINK WN553X1-B ovpn_file ioos sub_4162A8 os command injection
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The…
CVE-2026-120230Critical· 9.9WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection
A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from …
CVE-2026-120196Critical· 9.9WAVLINK WN579X3-D wapi.cgi port_forward os command injection
A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remo…
CVE-2026-113802Critical· 9.8PoCWavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler
Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests wit…
CVE-2026-110958Critical· 10.0PoCA vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724
A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The ex…
CVE-2026-110957Critical· 10.0PoCA vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os …
CVE-2026-109110Critical· 10.0PoCA flaw has been found in Wavlink WL-WN592AX6 250422
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The explo…
CVE-2026-109109Critical· 10.0A vulnerability was detected in Wavlink WL-WN530BE1-A 251117
A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTP_…
CVE-2026-109108Critical· 9.9A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be perfo…
CVE-2026-109107Medium· 6.5PoCA weakness has been identified in Wavlink WL-WN592AX6 250422
A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible t…
CVE-2026-8230Medium· 6.3A flaw has been found in Wavlink NU516U1 240425
A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed…
CVE-2026-8229Medium· 6.3A vulnerability was detected in Wavlink NU516U1 240425
A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument AuthMethod/EncrypType results in os command injection. Re…
CVE-2026-8228Medium· 6.3A security vulnerability has been detected in Wavlink NU516U1 240425
A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlan_conf/Channel/skiplist/ieee_80211h leads to os command inject…
CVE-2026-8227Medium· 6.3A weakness has been identified in Wavlink NU516U1 240425
A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os command injection. The attack may be initiated remotely. The exploit has been m…
CVE-2025-10964Medium· 6.3A weakness has been identified in Wavlink NU516U1
A weakness has been identified in Wavlink NU516U1. Affected by this vulnerability is the function sub_401B30 of the file /cgi-bin/firewall.cgi. This manipulation of the argument remoteManagementEnabled causes command injection. The attac…
CVE-2025-10963Medium· 6.3A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425
A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. Affected is the function sub_4016F0 of the file /cgi-bin/firewall.cgi. The manipulation of the argument del_flag results in command injection. It is possible to launch…