WAVLINK has 40 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 28 in the last 90 days against 0 in the 90 before. The busiest recent month was November 2026 with 21. The median CVSS is 9.9 (critical), with 26 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-77 (33) and CWE-78 (26). Most affected products: wl-nu516u1_firmware (11), WN536AX6-A (7), WN553X1-B (6).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.9
- Publish → KEV
- —
- Last 90 days
- 28 prev 0
Products
- wl-nu516u1_firmware 11
- WN536AX6-A 7
- WN553X1-B 6
- WL-WN530BE1-A 4
- WL-WN592AX6 2
- WN551X3-A 2
Worst active — by depth score
CVE-2026-120276Critical· 10.0WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection68CVE-2026-110957Critical· 10.0A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V25060468CVE-2026-120345Critical· 10.0WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection67CVE-2026-120344Critical· 10.0WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection67CVE-2026-120282Critical· 9.9WAVLINK WN536AX6-A protocol.csp host_black os command injection67
WAVLINK vulnerabilities
CVEs affecting WAVLINK, newest first. Open any entry for full detail, references, and exploit status.
40 CVEsRSS
CVE-2026-8228Medium· 6.3A security vulnerability has been detected in Wavlink NU516U1 240425
A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlan_conf/Channel/skiplist/ieee_80211h leads to os command inject…
CVE-2026-8227Medium· 6.3A weakness has been identified in Wavlink NU516U1 240425
A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os command injection. The attack may be initiated remotely. The exploit has been m…
CVE-2025-10964Medium· 6.3A weakness has been identified in Wavlink NU516U1
A weakness has been identified in Wavlink NU516U1. Affected by this vulnerability is the function sub_401B30 of the file /cgi-bin/firewall.cgi. This manipulation of the argument remoteManagementEnabled causes command injection. The attac…
CVE-2025-10963Medium· 6.3A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425
A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. Affected is the function sub_4016F0 of the file /cgi-bin/firewall.cgi. The manipulation of the argument del_flag results in command injection. It is possible to launch…
CVE-2025-10962Medium· 6.3A vulnerability was identified in Wavlink NU516U1 M16U1_V240425
A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This impacts the function sub_403198 of the file /cgi-bin/wireless.cgi of the component SetName Page. The manipulation of the argument mac_5g leads to command injection. It…
CVE-2025-10961Medium· 5.5A vulnerability was determined in Wavlink NU516U1 M16U1_V240425
A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. This affects the function sub_4030C0 of the file /cgi-bin/wireless.cgi of the component Delete_Mac_list Page. Executing manipulation of the argument delete_list can lead to…
CVE-2025-10960Medium· 6.3A vulnerability was found in Wavlink NU516U1 M16U1_V240425
A vulnerability was found in Wavlink NU516U1 M16U1_V240425. The impacted element is the function sub_402D1C of the file /cgi-bin/wireless.cgi of the component DeleteMac Page. Performing manipulation of the argument delete_list results in…
CVE-2025-10959Medium· 6.3A vulnerability has been found in Wavlink NU516U1 M16U1_V240425
A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. The affected element is the function sub_401778 of the file /cgi-bin/firewall.cgi. Such manipulation of the argument dmz_flag leads to command injection. The attack can be …
CVE-2025-10958Medium· 6.3A flaw has been found in Wavlink NU516U1 M16U1_V240425
A flaw has been found in Wavlink NU516U1 M16U1_V240425. Impacted is the function sub_403010 of the file /cgi-bin/wireless.cgi of the component AddMac Page. This manipulation of the argument macAddr causes command injection. Remote exploi…
CVE-2025-10321Medium· 5.3A flaw has been found in Wavlink WL-WN578W2 221110
A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is an unknown function of the file /live_online.shtml. Executing manipulation can lead to information disclosure. The attack can be executed remotely. The exploit has been publ…