Wavlink
Monthly
OS command injection in the OpenVPN CLI handler of WAVLINK WN553X1-B firmware V260403_2.0.0 allows a remote attacker holding low-level (authenticated) privileges to execute arbitrary OS commands by manipulating the file_id argument processed by sub_416568 in /bin/ioos. Successful exploitation gives full compromise of confidentiality, integrity and availability on the device, which is typically positioned at the network edge. No CISA KEV entry or other confirmation of active exploitation was supplied; a public PoC reference exists, but it is not verified as working exploit code, and the vulnerability is prioritized for remediation this week rather than as an emergency.
OS command injection in the del_vlan_group function of the WAVLINK WN701AE (firmware 260105) ioos web backend allows network-reachable attackers to execute arbitrary shell commands on the device. The CVSS 4.0 vector (PR:L, AC:L, UI:N) shows a low-complexity attack that requires a low-privilege authenticated session on the web management interface, with high confidentiality, integrity and availability impact across the vulnerable and subsequent systems; an EPSS-style exploitability metric of E:P and a public PoC reference (not verified as working exploit code) exist. No CISA KEV entry confirms active exploitation, but the flaw is considered high priority this week because of its severity and the presence of public technical detail.
OS command injection in WAVLINK WN553X1-B firmware V260403_2.0.0 lets a remote attacker with a low-privilege authenticated session execute arbitrary commands through the group_id and group_name arguments processed by sub_416D88 in /bin/ioos. The issue is CWE-78 and carries a CVSS 4.0 score of 8.6; exploitation requires reachability to the device's ioos Service, which is typically LAN-side or an exposed management interface rather than the open internet by default. A public PoC reference exists; it is not verified as working exploit code, and the supplied intelligence does not confirm active exploitation.
OS command injection in the WAVLINK WN701AE (firmware M01AE_V260105) ioos web backend lets a network-positioned attacker who already holds a low-privileged account execute arbitrary OS commands on the device by manipulating the rule_name argument of the del_staticrule function in static_route_setting.sh. Successful exploitation compromises confidentiality, integrity and availability of the router itself and can extend to connected systems (assessed CVSS:3.1 8.6, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A public PoC reference exists in a GitHub write-up; it is not verified as working exploit code, and no CISA KEV listing indicates confirmed active exploitation. The vendor was contacted about the disclosure.
Command injection in the WAVLINK WL-WN530BE1-A router (build V251117) allows unauthenticated remote attackers to execute arbitrary shell commands on the device by sending crafted requests to /protocol.csp that reach the con_check_read_finish function with malicious group_name or IP-FROM values. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are indicated as prerequisites, giving high confidentiality, integrity and availability impact. A public PoC reference exists (a GitHub write-up linked from the VulDB entry); it is not verified as working exploit code, and no CISA KEV listing is present in the supplied data, although the vuln.today decision label is act_now.
OS command injection in the port_forward handler of the WAVLINK WL-WN530HG4B router's web management CGI (/cgi-bin/wapi.cgi) allows an attacker who can reach and authenticate to the device's administrative interface to run arbitrary shell commands on the firmware by placing shell metacharacters in the Name argument of a port-forwarding configuration request. The issue affects firmware build M_V260724 and carries a CVSS 4.0 base score of 8.6, with high confidentiality, integrity and availability impact; the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the PR:L prerequisite, meaning the practical bar is authenticated access to the management UI rather than a fully unauthenticated internet-wide attack. A public PoC reference has been published in a GitHub write-up, but it is not verified as working exploit code, and no CISA KEV listing or EPSS score is available at time of analysis.
OS command injection (CWE-78) in the WAVLINK WN579X3-D wireless router (reported at firmware V250402) lets an attacker who can reach the web management interface execute arbitrary shell commands on the device by supplying a crafted 'Name' argument to the port_forward function of /cgi-bin/wapi.cgi. The vendor's CVSS 4.0 vector scores this 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality, integrity and availability impact), and the parallel assessment confirms remote reachability with low attack complexity but requires a low-privilege authenticated session on the management interface, so this is not a fully unauthenticated attack; exposure rises sharply where the admin interface is reachable from the WAN or default/weak credentials remain in place. A public PoC reference exists (a GitHub write-up linked from the VulDB entry) but has not been verified as working exploit code, and no confirmed active exploitation (CISA KEV) has been reported. Successful exploitation gives full control of the device's configuration and the traffic it forwards.
Unauthenticated OS command injection in the WAVLINK WL-WN579A3-A Initial Setup Wizard allows a remote attacker who can reach /cgi-bin/adm.cgi to execute arbitrary shell commands by supplying a crafted wlan_ssid argument to set_wzdgwMesh, with high confidentiality, integrity and availability impact (CVSS 4.0 score 9.3; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). The issue affects the named 2026-03-10-94f93d4 firmware and is tracked as CWE-78; a public PoC reference exists, but it is not verified as working exploit code, and no CISA KEV confirmation was provided. Exposure is mainly limited by whether the device HTTP management interface is reachable from untrusted networks, and the priority label is act_now with no vendor-released patch identified at time of analysis.
Unauthenticated OS command injection in Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 lets remote attackers execute arbitrary commands as root by forging an IP-FROM: 127.0.0.1 header to bypass login and supplying a crafted file_id parameter to /protocol.csp?opt=ovpn_file with type=del. Publicly available exploit code exists, and the VulnCheck advisory plus a public write-up describe the flaw; no CISA KEV confirmation was provided. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, making this a high-priority exposure when the management interface is reachable.
A heap-based buffer overflow in the api.cgi management handler of Wavlink WN530HG4B routers (firmware M30HG4B_V260724) allows unauthenticated remote attackers to corrupt heap memory by sending a crafted request to the api=info&client=app endpoint. The vulnerability is rated 9.3 under CVSS 4.0 (assessed 9.8 under CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting no authentication requirement, no user interaction, and full loss of confidentiality, integrity, and availability on the affected device. Publicly available exploit code exists, and while the issue is not confirmed as actively exploited (not in CISA KEV), the weaponizable nature of an unbounded parameter flowing into a shell-invoked handler makes patching exposed devices a priority; the vendor has released firmware 2026-09-24-841a51c6d5_tclinux.bin that resolves the flaw.
OS command injection in Wavlink WL-WN530BE2-A firmware up to M30BE2_V250604 lets remote attackers reach the api.cgi login handler (api=info&client=app, function sub_12580) and inject shell metacharacters through the value the firmware treats as the client address (REMOTE_ADDR), potentially yielding arbitrary command execution with root-level privileges on the device. The vendor has confirmed the finding and shipped a fix in firmware 2026-09-24-841a51c6d5_tclinux.bin, which replaces the system() call with execvp and length-limits/null-checks the client address; publicly available exploit code exists (a GitHub PoC), though the weakness is not confirmed as actively exploited (CISA KEV). Exploitation is not as trivial as the raw CVSS 4.0 score of 9.3 implies: REMOTE_ADDR is conventionally derived from the TCP source address, so a real-world attacker likely needs the web server to trust a client-supplied address header or needs an on-path/proxy position, which materially narrows the population of reachable targets despite PR:N in the published vector.
OS command injection in Wavlink WL-WN592AX6 firmware 250422 allows unauthenticated network attackers to execute arbitrary shell commands through the wmapd daemon's system function when they can reach the device management surface. The flaw is tracked as CVE-2026-109110 (CWE-78) with a 9.3 CVSS v4.0 score, and publicly available exploit code exists, though no confirmed active exploitation is indicated in the supplied data. Exploitation requires network access to the affected management interface; because this consumer range extender is typically LAN-facing, Internet exposure depends on WAN exposure or an attacker on the local/adjacent network.
Stack-based buffer overflow in the Wavlink WL-WN530BE1-A router (firmware build 251117) allows remote compromise of the device through its web management interface. An unauthenticated attacker who can reach the device's HTTP server can send a crafted request to /cgi-bin/ExportAllSettings.cgi with an oversized attacker-controlled HTTP_COOKIE / X-Cmd value, overwriting stack memory and potentially achieving code execution with full confidentiality, integrity, and availability impact. The issue is rated 9.3 under CVSS 4.0 and maps to an authoritative assessed CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; publicly available exploit code exists (no CISA KEV listing at time of analysis), and EPSS-style probability data was not provided, so risk is driven primarily by the unauthenticated, trivially reachable attack surface of the exposed CGI endpoint.
Command injection in the Wavlink WL-WN530BE1-A wireless router (firmware 251117) allows an authenticated, low-privileged user of the web management interface to execute arbitrary shell commands on the device via the 'Type' parameter of /cgi-bin/uploadVpn.cgi, which is passed unsanitized into a popen() call. Because the flaw requires only a valid session (CVSS PR:L) with no user interaction (UI:N) and generally only LAN-side reachability to the management interface, the practical barrier is low: SOHO devices frequently ship with default or weak admin credentials. Publicly available exploit code exists (a published GitHub gist), but no confirmed active exploitation (CISA KEV) has been reported, and no vendor-released patch version is identified in the available data.
Remote code execution in Wavlink WN531P3 and WN535M1 (firmware V250922) consumer routers arises from an unsafe strcpy in the export_pingortrace.cgi binary, where the attacker-controlled HTTP_COOKIE header is copied into a fixed stack buffer without bounds checking. Unauthenticated remote attackers can send a crafted Cookie header to the device web interface to overflow the stack and hijack execution. Publicly available exploit code exists (disclosed via VulDB with a PoC report), but there is no public exploit identified as actively exploited in the wild, and no CISA KEV listing.
Stack-based buffer overflow in Wavlink's lighttpd-based web interface allows network-adjacent authenticated attackers to achieve arbitrary code execution on at least thirteen SOHO router and range-extender models running firmware through 20260609. The vulnerable code path is the strcpy call within upload.cgi, which copies the HTTP_COOKIE request header into a fixed-size stack buffer without length validation. Publicly available exploit code exists on GitHub (0xcc12138/WAVLINK-vul); no CISA KEV listing is present, but the disclosed POC materially lowers the exploitation barrier for opportunistic actors targeting consumer networking gear.
Stack-based buffer overflow in the Wavlink WL-NU516U1 NAS device's nas.cgi password change handler allows remote unauthenticated attackers to potentially execute arbitrary code by supplying an oversized User1Passwd argument to the change_password function. Affecting the MT7628 firmware variant (708c073-mt7628), this carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact and no privileges or user interaction required. A public proof-of-concept has been published and a vendor-released firmware patch is available as of 2026-07-13; no confirmed CISA KEV listing at time of analysis.
Stack-based buffer overflow in the Wavlink WL-NU516U1 (firmware 708c073-mt7628) router's nas.cgi handler lets remote unauthenticated attackers overflow a fixed-size stack buffer by manipulating the HTTP CONTENT_LENGTH value processed via fgets. Successful exploitation can crash the device or execute arbitrary code with full compromise of confidentiality, integrity, and availability. A public write-up (GitHub report2.md) exists, but the flaw is not listed in CISA KEV - no public weaponized exploit is confirmed at time of analysis.
Stack-based buffer overflow in the Wavlink WL-NU516U1-A wireless range extender (firmware M16U1_V240425) lets a remote, low-privileged attacker corrupt memory by sending an oversized Guest_ssid POST parameter to the sub_407504 function in /cgi-bin/wireless.cgi. The flaw was reported by VulDB, publicly available exploit code exists, and it carries a CVSS 4.0 base score of 7.4; there is no evidence of active exploitation in CISA KEV at this time.
OS command injection in Wavlink WL-WN530H4 router's internet.cgi endpoint allows authenticated attackers with high privileges to execute arbitrary system commands remotely. The vulnerability, affecting firmware version 20220721, resides in unsafe use of strcat/snprintf functions handling user input. Public exploit code exists (EPSS risk elevated by POC availability), though exploitation requires administrative credentials (PR:H), limiting automated mass exploitation. Vendor-released firmware patch 2026.04.16 available.
Remote attackers can exploit a stack-based buffer overflow in the /cgi-bin/nas.cgi endpoint of Wavlink WL-NU516U1 by manipulating the Content-Length parameter to achieve unauthenticated remote code execution. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. Authentication is required to trigger the flaw, limiting exposure to authenticated users or those with network access to the device.
Critical command injection vulnerability in Wavlink WL-WN578W2 wireless routers (firmware version 221110) that allows unauthenticated remote attackers to execute arbitrary commands via specially crafted POST requests to multiple functions in the wireless.cgi script. A public proof-of-concept exploit is available on GitHub, and the vendor has released a patch, making this a high-priority issue for immediate remediation despite no current KEV listing.
Critical command injection vulnerability in Wavlink WL-WN579A3 wireless router firmware version 220323, allowing unauthenticated remote attackers to execute arbitrary commands via the SetName/GuestWifi functions in /cgi-bin/wireless.cgi. A public proof-of-concept exploit is available, and while a vendor patch exists, the vulnerability has not yet been added to CISA's KEV catalog despite its high severity (CVSS 9.8).
Remote code execution in Wavlink WL-WN579X3-C firmware through stack-based buffer overflow in the firewall.cgi module allows unauthenticated attackers to achieve complete system compromise via manipulation of the del_flag parameter. Public exploit code exists for this vulnerability, and no patch is currently available despite vendor notification. Affected users should immediately restrict network access to the affected device until a firmware update becomes available.
Wavlink NU516U1 firmware 251208 has a buffer overflow enabling remote code execution through crafted HTTP requests to the CGI interface.
Stack-based buffer overflow in Wavlink WL-NU516U1 firmware's login.cgi allows remote attackers with high privileges to achieve complete system compromise through a malformed ipaddr parameter. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw enables unauthenticated remote code execution with full read, write, and execution capabilities on affected devices.
Remote code execution in Wavlink WL-NU516U1 firmware allows unauthenticated attackers to execute arbitrary commands through the firmware_url parameter in the OTA upgrade function, requiring only high-level privileges to trigger. Public exploit code exists for this vulnerability and no patch is currently available, making it an immediate risk for affected devices.
Wl-Nu516U1 Firmware versions up to 20251208. contains a vulnerability that allows attackers to command injection (CVSS 7.2).
Remote code execution in Wavlink WL-NU516U1 firmware through a stack-based buffer overflow in the nas.cgi User1Passwd parameter allows unauthenticated network attackers to achieve full system compromise. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected devices at immediate risk.
A remotely triggerable null pointer dereference in the Wavlink WL-WN592AX6 range extender's web management interface (firmware build 250422) allows unauthenticated attackers to crash the /cgi-bin/upload.cgi handler by sending a crafted Cookie header, resulting in a denial of service. Publicly available exploit code exists (no CISA KEV confirmation), and the CVSS 4.0 base score is 6.9, but our independent assessment rates the practical risk as low-to-moderate because these devices are typically confined to local networks and exploitation requires reachability to the management interface. There is no code execution or data disclosure; the impact is limited to availability of the CGI handler.
OS command injection in the Wavlink WL-NU516U1 router's admin password handler allows a remote, low-privileged authenticated attacker to execute arbitrary operating system commands via the set_sys_adm function in adm.cgi. The affected firmware version is 708c073-mt7628, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the vendor has responded promptly and released a patched firmware dated 2026-07-13.
OS command injection in the Wavlink WL-NU516U1 firmware (build 708c073-mt7628) allows remote attackers to execute arbitrary operating system commands by supplying a crafted Password argument to the Config Import component. The CVSS 4.0 score of 7.7 reflects meaningful constraints - high attack complexity (AC:H) and required user interaction (UI:P) - yet the full confidentiality, integrity, and availability impact on the vulnerable system remains high. A proof-of-concept exploit has been publicly published on GitHub, and the vendor has already released a patched firmware binary, making this a time-sensitive patching priority for any deployment of the affected firmware build.
OS command injection in the Wavlink WL-NU516U1 router's CGI web administration interface allows authenticated network attackers to execute arbitrary operating system commands by injecting shell metacharacters into the lan_ip parameter of the adm.cgi endpoint. The wlink_uci_set_value function passes attacker-controlled input unsanitized into OS-level commands, enabling full compromise of the underlying Linux-based router OS. A public proof-of-concept exploit is available on GitHub (no public exploit identified at time of analysis for KEV), and the vendor has released a patched firmware as of June 22, 2026.
Command injection in Wavlink WL-NU516U1-A router firmware (M16U1_V240425) allows authenticated remote attackers to execute arbitrary OS commands by submitting crafted POST parameters to the wireless CGI configuration handler. The affected function sub_401D68 within /cgi-bin/wireless.cgi fails to sanitize the SSID2G2, SSID5G2, AuthMethod2, and WPAPSK12 parameters before passing them to OS-level commands. A public proof-of-concept exploit is confirmed available on GitHub; this CVE is not currently listed in CISA's KEV catalog, but the vendor has already released a patched firmware.
OS command injection in Wavlink NU516U1 240425 via the ipaddr parameter in /cgi-bin/login.cgi allows authenticated remote attackers to execute arbitrary system commands with limited impact (confidentiality, integrity, availability). The vulnerability requires valid credentials (PR:L) but can be exploited over the network without user interaction. Publicly available exploit code exists, and the vendor was notified during coordinated disclosure.
Remote command injection in Wavlink NU516U1 240425 allows authenticated attackers to execute arbitrary OS commands via manipulation of the AuthMethod or EncrypType arguments in the WifiBasic function of /cgi-bin/wireless.cgi. Publicly available exploit code exists, and the vendor was notified early of the disclosure.
OS command injection in Wavlink NU516U1 240425 wireless configuration module allows authenticated remote attackers to execute arbitrary system commands via manipulation of the wlan_conf/Channel/skiplist/ieee_80211h parameter in /cgi-bin/wireless.cgi. Publicly available exploit code exists, and the vendor was notified early of disclosure. CVSS 6.3 reflects the moderate impact of command execution under authenticated conditions.
Remote OS command injection in Wavlink NU516U1 240425 via the wzdapMesh function in /cgi-bin/adm.cgi allows authenticated remote attackers to execute arbitrary operating system commands with limited system impact. Publicly available exploit code exists, and the vendor has been notified of the disclosure.
Wavlink NU516U1 M16U1_V240425 is vulnerable to remote OS command injection through the wzdap function in /cgi-bin/adm.cgi, where the EncrypType and wl_Pass parameters are passed unsanitized to system commands. An authenticated remote attacker can manipulate these arguments to execute arbitrary commands with the privileges of the web server process. Exploit code is publicly available (CVSS 6.3, EPSS probability indicated by E:P vector).
Remote OS command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated remote attackers to execute arbitrary system commands via the skiplist1/skiplist2 parameters in the wifi_region function of /cgi-bin/adm.cgi. The vulnerability is remotely exploitable with low complexity, affects confidentiality and integrity, and has publicly available exploit code.
OS command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated remote attackers to execute arbitrary system commands via unsanitized WAN configuration parameters (ppp_username, ppp_passwd, rwan_ip, rwan_mask, rwan_gateway) in the /cgi-bin/adm.cgi wan function. Publicly available exploit code exists and the vendor has been notified.
Remote authenticated command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated attackers to execute arbitrary OS commands via manipulation of wlan_bssid, sel_Automode, or sel_EncrypTyp parameters in the wzdrepeater function at /cgi-bin/adm.cgi. CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P) with public exploit code available; vendor was notified early of this disclosure.
OS command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated remote attackers to execute arbitrary commands via the change_wifi_password function in /cgi-bin/adm.cgi by manipulating the wl_channel, wl_Pass, or EncrypType parameters. Publicly available exploit code exists, and the vendor has been notified of the vulnerability.
Command injection in Wavlink WL-WN570HA1 firmware version R70HA1 V1410_221110 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the DDNS argument in the ping_ddns function of /cgi-bin/adm.cgi. The vulnerability affects only unsupported end-of-life firmware that the vendor has removed from distribution; publicly available exploit code exists but real-world impact is limited due to end-of-support status and authentication requirement.
Command injection in Wavlink WL-WN570HA1 firmware version R70HA1 V1410_221110 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the command argument in the set_sys_cmd function of /cgi-bin/adm.cgi. The vulnerability has publicly available exploit code and affects only discontinued products no longer maintained by the vendor.
Command injection in Wavlink WL-WN570HA1 firmware R70HA1 V1410_221110 allows authenticated remote attackers to execute arbitrary commands via the Username parameter in the set_sys_adm function of /cgi-bin/adm.cgi. Publicly available exploit code exists for this vulnerability affecting end-of-life hardware no longer supported by the vendor.
Stored cross-site scripting (XSS) in Wavlink WL-WN579A3 wireless router allows remote unauthenticated attackers to inject malicious scripts via the Hostname parameter in /cgi-bin/login.cgi, affecting all firmware versions prior to 2026-03-10. The vulnerability requires user interaction (UI:R) to trigger payload execution in a victim's browser, limiting direct remote code execution but enabling credential theft, session hijacking, or malware distribution. A vendor patch was released promptly after responsible disclosure.
A Stored/Reflected Cross-Site Scripting (XSS) vulnerability exists in the Wavlink WL-WN578W2 wireless router (firmware version 221110 and potentially others) within the POST request handler of /cgi-bin/login.cgi. An attacker with high privileges can manipulate the homepage, hostname, or login_page parameters to inject malicious JavaScript that executes in the context of other users' browsers. A proof-of-concept has been publicly disclosed on GitHub, and the vendor has not responded to early disclosure notifications, leaving affected devices unpatched.
Wavlink WL-WN578W2 routers contain a command injection vulnerability in the /cgi-bin/firewall.cgi POST handler that allows authenticated attackers to execute arbitrary commands by manipulating the dmz_flag or del_flag parameters. The vulnerability is remotely exploitable and has public exploit code available, though no patch has been released. An attacker with network access and valid credentials could achieve code execution with the privileges of the web service.
A vulnerability was found in Wavlink WL-NU516U1 240425.
A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This vulnerability affects the function sub_401AD4 of the file /cgi-bin/adm.cgi. [CVSS 2.4 LOW]
Command injection in Wavlink NU516U1 firmware's firewall CGI component allows authenticated remote attackers to execute arbitrary commands with network access. Public exploit code exists for this vulnerability, which stems from an incomplete fix of a prior CVE. A patch is not currently available, though the vendor has been notified and indicated a fix is in development.
Command injection in Wavlink WL-NU516U1 firmware allows remote attackers with high privileges to execute arbitrary commands through the Pr_mode parameter in /cgi-bin/adm.cgi. Public exploit code exists for this vulnerability, and no patch is currently available. The impact is limited to confidentiality, integrity, and availability of the affected device.
Command injection in Wavlink WL-NU516U1 firmware allows remote attackers with high privileges to execute arbitrary commands through the model parameter in the OTA upgrade function. Public exploit code exists for this vulnerability, and no patch is currently available. The impact is limited to confidentiality, integrity, and availability of the affected device.
Stack overflow in Wavlink WL-NU516U1 firmware's /cgi-bin/adm.cgi allows remote attackers with high privileges to achieve code execution via a malicious time_zone parameter. Public exploit code exists for this vulnerability, though exploitation requires high complexity and the vendor has not released a patch.
The WL-WN579A3 wireless router firmware contains a command injection vulnerability in the AddMac function of /cgi-bin/wireless.cgi that allows authenticated remote attackers to execute arbitrary commands with medium impact on confidentiality, integrity, and availability. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. Affected systems running firmware versions up to 20210219 require immediate mitigation through network segmentation or device replacement.
Unauthenticated command injection in the wireless configuration interface of Wavlink WL-WN579A3 firmware allows remote attackers to execute arbitrary commands through the delete_list parameter. Public exploit code is available for this vulnerability, and no patch has been released by the vendor despite early notification. Affected devices can be compromised remotely to gain full system access with minimal authentication requirements.
Command injection in the Wavlink WL-WN579A3 wireless router firmware allows authenticated remote attackers to execute arbitrary commands through the delete_list parameter in the /cgi-bin/wireless.cgi endpoint. Public exploit code exists for this vulnerability, and no vendor patch is currently available. Affected devices running firmware versions up to 20210219 face risk of complete system compromise from authenticated network access.
Wl-Wn579A3 Firmware versions up to 20210219. contains a vulnerability that allows attackers to command injection (CVSS 6.3).
Command injection in Wavlink WL-WN579A3 firmware through the SSID2G2 parameter of /cgi-bin/wireless.cgi allows authenticated remote attackers to execute arbitrary commands with limited privileges. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor. The flaw affects confidentiality, integrity, and availability of affected devices.
Wavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Wavlink NU516U1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. Rated medium severity (CVSS 5.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Wavlink NU516U1 M16U1_V240425. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Wavlink NU516U1 M16U1_V240425. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Wavlink WL-NU516U1 240425. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Wavlink WL-WN578W2 221110. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Wavlink WL-WN578W2 221110. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Wavlink WL-WN578W2 221110. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Wavlink WL-WN578W2 221110. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Wavlink WL-WN578W2 221110. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Wavlink WL-WN578W2 221110. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Wavlink WL-WN578W2 221110. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the username parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_cmd function via the command parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Wavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection while resetting the password. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Wavlink WL-NU516U1 M16U1_V240425. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
CVE-2025-50756 is a critical unauthenticated command injection vulnerability in the Wavlink WN535K3 router (firmware version 20191010) affecting the set_sys_adm function's newpass parameter. An unauthenticated remote attacker can execute arbitrary system commands with root privileges by sending a crafted request, enabling complete device compromise including data theft, malware installation, and lateral network movement. The CVSS 9.8 score reflects maximum severity; KEV status and active exploitation likelihood are elevated given the high exploitability characteristics (network-accessible, no authentication required, low attack complexity).
A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 13.0%.
A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 13.0%.
A command injection vulnerability in the component /cgi-bin/qos.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 13.0%.
Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.cgi via the pingIp parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple buffer overflow vulnerabilities in Wavlink WL-WN575A3 RPT75A3.V4300, which are caused by not performing strict length checks on user-controlled data. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OS command injection in the OpenVPN CLI handler of WAVLINK WN553X1-B firmware V260403_2.0.0 allows a remote attacker holding low-level (authenticated) privileges to execute arbitrary OS commands by manipulating the file_id argument processed by sub_416568 in /bin/ioos. Successful exploitation gives full compromise of confidentiality, integrity and availability on the device, which is typically positioned at the network edge. No CISA KEV entry or other confirmation of active exploitation was supplied; a public PoC reference exists, but it is not verified as working exploit code, and the vulnerability is prioritized for remediation this week rather than as an emergency.
OS command injection in the del_vlan_group function of the WAVLINK WN701AE (firmware 260105) ioos web backend allows network-reachable attackers to execute arbitrary shell commands on the device. The CVSS 4.0 vector (PR:L, AC:L, UI:N) shows a low-complexity attack that requires a low-privilege authenticated session on the web management interface, with high confidentiality, integrity and availability impact across the vulnerable and subsequent systems; an EPSS-style exploitability metric of E:P and a public PoC reference (not verified as working exploit code) exist. No CISA KEV entry confirms active exploitation, but the flaw is considered high priority this week because of its severity and the presence of public technical detail.
OS command injection in WAVLINK WN553X1-B firmware V260403_2.0.0 lets a remote attacker with a low-privilege authenticated session execute arbitrary commands through the group_id and group_name arguments processed by sub_416D88 in /bin/ioos. The issue is CWE-78 and carries a CVSS 4.0 score of 8.6; exploitation requires reachability to the device's ioos Service, which is typically LAN-side or an exposed management interface rather than the open internet by default. A public PoC reference exists; it is not verified as working exploit code, and the supplied intelligence does not confirm active exploitation.
OS command injection in the WAVLINK WN701AE (firmware M01AE_V260105) ioos web backend lets a network-positioned attacker who already holds a low-privileged account execute arbitrary OS commands on the device by manipulating the rule_name argument of the del_staticrule function in static_route_setting.sh. Successful exploitation compromises confidentiality, integrity and availability of the router itself and can extend to connected systems (assessed CVSS:3.1 8.6, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A public PoC reference exists in a GitHub write-up; it is not verified as working exploit code, and no CISA KEV listing indicates confirmed active exploitation. The vendor was contacted about the disclosure.
Command injection in the WAVLINK WL-WN530BE1-A router (build V251117) allows unauthenticated remote attackers to execute arbitrary shell commands on the device by sending crafted requests to /protocol.csp that reach the con_check_read_finish function with malicious group_name or IP-FROM values. Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are indicated as prerequisites, giving high confidentiality, integrity and availability impact. A public PoC reference exists (a GitHub write-up linked from the VulDB entry); it is not verified as working exploit code, and no CISA KEV listing is present in the supplied data, although the vuln.today decision label is act_now.
OS command injection in the port_forward handler of the WAVLINK WL-WN530HG4B router's web management CGI (/cgi-bin/wapi.cgi) allows an attacker who can reach and authenticate to the device's administrative interface to run arbitrary shell commands on the firmware by placing shell metacharacters in the Name argument of a port-forwarding configuration request. The issue affects firmware build M_V260724 and carries a CVSS 4.0 base score of 8.6, with high confidentiality, integrity and availability impact; the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the PR:L prerequisite, meaning the practical bar is authenticated access to the management UI rather than a fully unauthenticated internet-wide attack. A public PoC reference has been published in a GitHub write-up, but it is not verified as working exploit code, and no CISA KEV listing or EPSS score is available at time of analysis.
OS command injection (CWE-78) in the WAVLINK WN579X3-D wireless router (reported at firmware V250402) lets an attacker who can reach the web management interface execute arbitrary shell commands on the device by supplying a crafted 'Name' argument to the port_forward function of /cgi-bin/wapi.cgi. The vendor's CVSS 4.0 vector scores this 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N with high confidentiality, integrity and availability impact), and the parallel assessment confirms remote reachability with low attack complexity but requires a low-privilege authenticated session on the management interface, so this is not a fully unauthenticated attack; exposure rises sharply where the admin interface is reachable from the WAN or default/weak credentials remain in place. A public PoC reference exists (a GitHub write-up linked from the VulDB entry) but has not been verified as working exploit code, and no confirmed active exploitation (CISA KEV) has been reported. Successful exploitation gives full control of the device's configuration and the traffic it forwards.
Unauthenticated OS command injection in the WAVLINK WL-WN579A3-A Initial Setup Wizard allows a remote attacker who can reach /cgi-bin/adm.cgi to execute arbitrary shell commands by supplying a crafted wlan_ssid argument to set_wzdgwMesh, with high confidentiality, integrity and availability impact (CVSS 4.0 score 9.3; assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H). The issue affects the named 2026-03-10-94f93d4 firmware and is tracked as CWE-78; a public PoC reference exists, but it is not verified as working exploit code, and no CISA KEV confirmation was provided. Exposure is mainly limited by whether the device HTTP management interface is reachable from untrusted networks, and the priority label is act_now with no vendor-released patch identified at time of analysis.
Unauthenticated OS command injection in Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 lets remote attackers execute arbitrary commands as root by forging an IP-FROM: 127.0.0.1 header to bypass login and supplying a crafted file_id parameter to /protocol.csp?opt=ovpn_file with type=del. Publicly available exploit code exists, and the VulnCheck advisory plus a public write-up describe the flaw; no CISA KEV confirmation was provided. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, making this a high-priority exposure when the management interface is reachable.
A heap-based buffer overflow in the api.cgi management handler of Wavlink WN530HG4B routers (firmware M30HG4B_V260724) allows unauthenticated remote attackers to corrupt heap memory by sending a crafted request to the api=info&client=app endpoint. The vulnerability is rated 9.3 under CVSS 4.0 (assessed 9.8 under CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting no authentication requirement, no user interaction, and full loss of confidentiality, integrity, and availability on the affected device. Publicly available exploit code exists, and while the issue is not confirmed as actively exploited (not in CISA KEV), the weaponizable nature of an unbounded parameter flowing into a shell-invoked handler makes patching exposed devices a priority; the vendor has released firmware 2026-09-24-841a51c6d5_tclinux.bin that resolves the flaw.
OS command injection in Wavlink WL-WN530BE2-A firmware up to M30BE2_V250604 lets remote attackers reach the api.cgi login handler (api=info&client=app, function sub_12580) and inject shell metacharacters through the value the firmware treats as the client address (REMOTE_ADDR), potentially yielding arbitrary command execution with root-level privileges on the device. The vendor has confirmed the finding and shipped a fix in firmware 2026-09-24-841a51c6d5_tclinux.bin, which replaces the system() call with execvp and length-limits/null-checks the client address; publicly available exploit code exists (a GitHub PoC), though the weakness is not confirmed as actively exploited (CISA KEV). Exploitation is not as trivial as the raw CVSS 4.0 score of 9.3 implies: REMOTE_ADDR is conventionally derived from the TCP source address, so a real-world attacker likely needs the web server to trust a client-supplied address header or needs an on-path/proxy position, which materially narrows the population of reachable targets despite PR:N in the published vector.
OS command injection in Wavlink WL-WN592AX6 firmware 250422 allows unauthenticated network attackers to execute arbitrary shell commands through the wmapd daemon's system function when they can reach the device management surface. The flaw is tracked as CVE-2026-109110 (CWE-78) with a 9.3 CVSS v4.0 score, and publicly available exploit code exists, though no confirmed active exploitation is indicated in the supplied data. Exploitation requires network access to the affected management interface; because this consumer range extender is typically LAN-facing, Internet exposure depends on WAN exposure or an attacker on the local/adjacent network.
Stack-based buffer overflow in the Wavlink WL-WN530BE1-A router (firmware build 251117) allows remote compromise of the device through its web management interface. An unauthenticated attacker who can reach the device's HTTP server can send a crafted request to /cgi-bin/ExportAllSettings.cgi with an oversized attacker-controlled HTTP_COOKIE / X-Cmd value, overwriting stack memory and potentially achieving code execution with full confidentiality, integrity, and availability impact. The issue is rated 9.3 under CVSS 4.0 and maps to an authoritative assessed CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; publicly available exploit code exists (no CISA KEV listing at time of analysis), and EPSS-style probability data was not provided, so risk is driven primarily by the unauthenticated, trivially reachable attack surface of the exposed CGI endpoint.
Command injection in the Wavlink WL-WN530BE1-A wireless router (firmware 251117) allows an authenticated, low-privileged user of the web management interface to execute arbitrary shell commands on the device via the 'Type' parameter of /cgi-bin/uploadVpn.cgi, which is passed unsanitized into a popen() call. Because the flaw requires only a valid session (CVSS PR:L) with no user interaction (UI:N) and generally only LAN-side reachability to the management interface, the practical barrier is low: SOHO devices frequently ship with default or weak admin credentials. Publicly available exploit code exists (a published GitHub gist), but no confirmed active exploitation (CISA KEV) has been reported, and no vendor-released patch version is identified in the available data.
Remote code execution in Wavlink WN531P3 and WN535M1 (firmware V250922) consumer routers arises from an unsafe strcpy in the export_pingortrace.cgi binary, where the attacker-controlled HTTP_COOKIE header is copied into a fixed stack buffer without bounds checking. Unauthenticated remote attackers can send a crafted Cookie header to the device web interface to overflow the stack and hijack execution. Publicly available exploit code exists (disclosed via VulDB with a PoC report), but there is no public exploit identified as actively exploited in the wild, and no CISA KEV listing.
Stack-based buffer overflow in Wavlink's lighttpd-based web interface allows network-adjacent authenticated attackers to achieve arbitrary code execution on at least thirteen SOHO router and range-extender models running firmware through 20260609. The vulnerable code path is the strcpy call within upload.cgi, which copies the HTTP_COOKIE request header into a fixed-size stack buffer without length validation. Publicly available exploit code exists on GitHub (0xcc12138/WAVLINK-vul); no CISA KEV listing is present, but the disclosed POC materially lowers the exploitation barrier for opportunistic actors targeting consumer networking gear.
Stack-based buffer overflow in the Wavlink WL-NU516U1 NAS device's nas.cgi password change handler allows remote unauthenticated attackers to potentially execute arbitrary code by supplying an oversized User1Passwd argument to the change_password function. Affecting the MT7628 firmware variant (708c073-mt7628), this carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact and no privileges or user interaction required. A public proof-of-concept has been published and a vendor-released firmware patch is available as of 2026-07-13; no confirmed CISA KEV listing at time of analysis.
Stack-based buffer overflow in the Wavlink WL-NU516U1 (firmware 708c073-mt7628) router's nas.cgi handler lets remote unauthenticated attackers overflow a fixed-size stack buffer by manipulating the HTTP CONTENT_LENGTH value processed via fgets. Successful exploitation can crash the device or execute arbitrary code with full compromise of confidentiality, integrity, and availability. A public write-up (GitHub report2.md) exists, but the flaw is not listed in CISA KEV - no public weaponized exploit is confirmed at time of analysis.
Stack-based buffer overflow in the Wavlink WL-NU516U1-A wireless range extender (firmware M16U1_V240425) lets a remote, low-privileged attacker corrupt memory by sending an oversized Guest_ssid POST parameter to the sub_407504 function in /cgi-bin/wireless.cgi. The flaw was reported by VulDB, publicly available exploit code exists, and it carries a CVSS 4.0 base score of 7.4; there is no evidence of active exploitation in CISA KEV at this time.
OS command injection in Wavlink WL-WN530H4 router's internet.cgi endpoint allows authenticated attackers with high privileges to execute arbitrary system commands remotely. The vulnerability, affecting firmware version 20220721, resides in unsafe use of strcat/snprintf functions handling user input. Public exploit code exists (EPSS risk elevated by POC availability), though exploitation requires administrative credentials (PR:H), limiting automated mass exploitation. Vendor-released firmware patch 2026.04.16 available.
Remote attackers can exploit a stack-based buffer overflow in the /cgi-bin/nas.cgi endpoint of Wavlink WL-NU516U1 by manipulating the Content-Length parameter to achieve unauthenticated remote code execution. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. Authentication is required to trigger the flaw, limiting exposure to authenticated users or those with network access to the device.
Critical command injection vulnerability in Wavlink WL-WN578W2 wireless routers (firmware version 221110) that allows unauthenticated remote attackers to execute arbitrary commands via specially crafted POST requests to multiple functions in the wireless.cgi script. A public proof-of-concept exploit is available on GitHub, and the vendor has released a patch, making this a high-priority issue for immediate remediation despite no current KEV listing.
Critical command injection vulnerability in Wavlink WL-WN579A3 wireless router firmware version 220323, allowing unauthenticated remote attackers to execute arbitrary commands via the SetName/GuestWifi functions in /cgi-bin/wireless.cgi. A public proof-of-concept exploit is available, and while a vendor patch exists, the vulnerability has not yet been added to CISA's KEV catalog despite its high severity (CVSS 9.8).
Remote code execution in Wavlink WL-WN579X3-C firmware through stack-based buffer overflow in the firewall.cgi module allows unauthenticated attackers to achieve complete system compromise via manipulation of the del_flag parameter. Public exploit code exists for this vulnerability, and no patch is currently available despite vendor notification. Affected users should immediately restrict network access to the affected device until a firmware update becomes available.
Wavlink NU516U1 firmware 251208 has a buffer overflow enabling remote code execution through crafted HTTP requests to the CGI interface.
Stack-based buffer overflow in Wavlink WL-NU516U1 firmware's login.cgi allows remote attackers with high privileges to achieve complete system compromise through a malformed ipaddr parameter. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw enables unauthenticated remote code execution with full read, write, and execution capabilities on affected devices.
Remote code execution in Wavlink WL-NU516U1 firmware allows unauthenticated attackers to execute arbitrary commands through the firmware_url parameter in the OTA upgrade function, requiring only high-level privileges to trigger. Public exploit code exists for this vulnerability and no patch is currently available, making it an immediate risk for affected devices.
Wl-Nu516U1 Firmware versions up to 20251208. contains a vulnerability that allows attackers to command injection (CVSS 7.2).
Remote code execution in Wavlink WL-NU516U1 firmware through a stack-based buffer overflow in the nas.cgi User1Passwd parameter allows unauthenticated network attackers to achieve full system compromise. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected devices at immediate risk.
A remotely triggerable null pointer dereference in the Wavlink WL-WN592AX6 range extender's web management interface (firmware build 250422) allows unauthenticated attackers to crash the /cgi-bin/upload.cgi handler by sending a crafted Cookie header, resulting in a denial of service. Publicly available exploit code exists (no CISA KEV confirmation), and the CVSS 4.0 base score is 6.9, but our independent assessment rates the practical risk as low-to-moderate because these devices are typically confined to local networks and exploitation requires reachability to the management interface. There is no code execution or data disclosure; the impact is limited to availability of the CGI handler.
OS command injection in the Wavlink WL-NU516U1 router's admin password handler allows a remote, low-privileged authenticated attacker to execute arbitrary operating system commands via the set_sys_adm function in adm.cgi. The affected firmware version is 708c073-mt7628, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the vendor has responded promptly and released a patched firmware dated 2026-07-13.
OS command injection in the Wavlink WL-NU516U1 firmware (build 708c073-mt7628) allows remote attackers to execute arbitrary operating system commands by supplying a crafted Password argument to the Config Import component. The CVSS 4.0 score of 7.7 reflects meaningful constraints - high attack complexity (AC:H) and required user interaction (UI:P) - yet the full confidentiality, integrity, and availability impact on the vulnerable system remains high. A proof-of-concept exploit has been publicly published on GitHub, and the vendor has already released a patched firmware binary, making this a time-sensitive patching priority for any deployment of the affected firmware build.
OS command injection in the Wavlink WL-NU516U1 router's CGI web administration interface allows authenticated network attackers to execute arbitrary operating system commands by injecting shell metacharacters into the lan_ip parameter of the adm.cgi endpoint. The wlink_uci_set_value function passes attacker-controlled input unsanitized into OS-level commands, enabling full compromise of the underlying Linux-based router OS. A public proof-of-concept exploit is available on GitHub (no public exploit identified at time of analysis for KEV), and the vendor has released a patched firmware as of June 22, 2026.
Command injection in Wavlink WL-NU516U1-A router firmware (M16U1_V240425) allows authenticated remote attackers to execute arbitrary OS commands by submitting crafted POST parameters to the wireless CGI configuration handler. The affected function sub_401D68 within /cgi-bin/wireless.cgi fails to sanitize the SSID2G2, SSID5G2, AuthMethod2, and WPAPSK12 parameters before passing them to OS-level commands. A public proof-of-concept exploit is confirmed available on GitHub; this CVE is not currently listed in CISA's KEV catalog, but the vendor has already released a patched firmware.
OS command injection in Wavlink NU516U1 240425 via the ipaddr parameter in /cgi-bin/login.cgi allows authenticated remote attackers to execute arbitrary system commands with limited impact (confidentiality, integrity, availability). The vulnerability requires valid credentials (PR:L) but can be exploited over the network without user interaction. Publicly available exploit code exists, and the vendor was notified during coordinated disclosure.
Remote command injection in Wavlink NU516U1 240425 allows authenticated attackers to execute arbitrary OS commands via manipulation of the AuthMethod or EncrypType arguments in the WifiBasic function of /cgi-bin/wireless.cgi. Publicly available exploit code exists, and the vendor was notified early of the disclosure.
OS command injection in Wavlink NU516U1 240425 wireless configuration module allows authenticated remote attackers to execute arbitrary system commands via manipulation of the wlan_conf/Channel/skiplist/ieee_80211h parameter in /cgi-bin/wireless.cgi. Publicly available exploit code exists, and the vendor was notified early of disclosure. CVSS 6.3 reflects the moderate impact of command execution under authenticated conditions.
Remote OS command injection in Wavlink NU516U1 240425 via the wzdapMesh function in /cgi-bin/adm.cgi allows authenticated remote attackers to execute arbitrary operating system commands with limited system impact. Publicly available exploit code exists, and the vendor has been notified of the disclosure.
Wavlink NU516U1 M16U1_V240425 is vulnerable to remote OS command injection through the wzdap function in /cgi-bin/adm.cgi, where the EncrypType and wl_Pass parameters are passed unsanitized to system commands. An authenticated remote attacker can manipulate these arguments to execute arbitrary commands with the privileges of the web server process. Exploit code is publicly available (CVSS 6.3, EPSS probability indicated by E:P vector).
Remote OS command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated remote attackers to execute arbitrary system commands via the skiplist1/skiplist2 parameters in the wifi_region function of /cgi-bin/adm.cgi. The vulnerability is remotely exploitable with low complexity, affects confidentiality and integrity, and has publicly available exploit code.
OS command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated remote attackers to execute arbitrary system commands via unsanitized WAN configuration parameters (ppp_username, ppp_passwd, rwan_ip, rwan_mask, rwan_gateway) in the /cgi-bin/adm.cgi wan function. Publicly available exploit code exists and the vendor has been notified.
Remote authenticated command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated attackers to execute arbitrary OS commands via manipulation of wlan_bssid, sel_Automode, or sel_EncrypTyp parameters in the wzdrepeater function at /cgi-bin/adm.cgi. CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P) with public exploit code available; vendor was notified early of this disclosure.
OS command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated remote attackers to execute arbitrary commands via the change_wifi_password function in /cgi-bin/adm.cgi by manipulating the wl_channel, wl_Pass, or EncrypType parameters. Publicly available exploit code exists, and the vendor has been notified of the vulnerability.
Command injection in Wavlink WL-WN570HA1 firmware version R70HA1 V1410_221110 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the DDNS argument in the ping_ddns function of /cgi-bin/adm.cgi. The vulnerability affects only unsupported end-of-life firmware that the vendor has removed from distribution; publicly available exploit code exists but real-world impact is limited due to end-of-support status and authentication requirement.
Command injection in Wavlink WL-WN570HA1 firmware version R70HA1 V1410_221110 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the command argument in the set_sys_cmd function of /cgi-bin/adm.cgi. The vulnerability has publicly available exploit code and affects only discontinued products no longer maintained by the vendor.
Command injection in Wavlink WL-WN570HA1 firmware R70HA1 V1410_221110 allows authenticated remote attackers to execute arbitrary commands via the Username parameter in the set_sys_adm function of /cgi-bin/adm.cgi. Publicly available exploit code exists for this vulnerability affecting end-of-life hardware no longer supported by the vendor.
Stored cross-site scripting (XSS) in Wavlink WL-WN579A3 wireless router allows remote unauthenticated attackers to inject malicious scripts via the Hostname parameter in /cgi-bin/login.cgi, affecting all firmware versions prior to 2026-03-10. The vulnerability requires user interaction (UI:R) to trigger payload execution in a victim's browser, limiting direct remote code execution but enabling credential theft, session hijacking, or malware distribution. A vendor patch was released promptly after responsible disclosure.
A Stored/Reflected Cross-Site Scripting (XSS) vulnerability exists in the Wavlink WL-WN578W2 wireless router (firmware version 221110 and potentially others) within the POST request handler of /cgi-bin/login.cgi. An attacker with high privileges can manipulate the homepage, hostname, or login_page parameters to inject malicious JavaScript that executes in the context of other users' browsers. A proof-of-concept has been publicly disclosed on GitHub, and the vendor has not responded to early disclosure notifications, leaving affected devices unpatched.
Wavlink WL-WN578W2 routers contain a command injection vulnerability in the /cgi-bin/firewall.cgi POST handler that allows authenticated attackers to execute arbitrary commands by manipulating the dmz_flag or del_flag parameters. The vulnerability is remotely exploitable and has public exploit code available, though no patch has been released. An attacker with network access and valid credentials could achieve code execution with the privileges of the web service.
A vulnerability was found in Wavlink WL-NU516U1 240425.
A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This vulnerability affects the function sub_401AD4 of the file /cgi-bin/adm.cgi. [CVSS 2.4 LOW]
Command injection in Wavlink NU516U1 firmware's firewall CGI component allows authenticated remote attackers to execute arbitrary commands with network access. Public exploit code exists for this vulnerability, which stems from an incomplete fix of a prior CVE. A patch is not currently available, though the vendor has been notified and indicated a fix is in development.
Command injection in Wavlink WL-NU516U1 firmware allows remote attackers with high privileges to execute arbitrary commands through the Pr_mode parameter in /cgi-bin/adm.cgi. Public exploit code exists for this vulnerability, and no patch is currently available. The impact is limited to confidentiality, integrity, and availability of the affected device.
Command injection in Wavlink WL-NU516U1 firmware allows remote attackers with high privileges to execute arbitrary commands through the model parameter in the OTA upgrade function. Public exploit code exists for this vulnerability, and no patch is currently available. The impact is limited to confidentiality, integrity, and availability of the affected device.
Stack overflow in Wavlink WL-NU516U1 firmware's /cgi-bin/adm.cgi allows remote attackers with high privileges to achieve code execution via a malicious time_zone parameter. Public exploit code exists for this vulnerability, though exploitation requires high complexity and the vendor has not released a patch.
The WL-WN579A3 wireless router firmware contains a command injection vulnerability in the AddMac function of /cgi-bin/wireless.cgi that allows authenticated remote attackers to execute arbitrary commands with medium impact on confidentiality, integrity, and availability. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. Affected systems running firmware versions up to 20210219 require immediate mitigation through network segmentation or device replacement.
Unauthenticated command injection in the wireless configuration interface of Wavlink WL-WN579A3 firmware allows remote attackers to execute arbitrary commands through the delete_list parameter. Public exploit code is available for this vulnerability, and no patch has been released by the vendor despite early notification. Affected devices can be compromised remotely to gain full system access with minimal authentication requirements.
Command injection in the Wavlink WL-WN579A3 wireless router firmware allows authenticated remote attackers to execute arbitrary commands through the delete_list parameter in the /cgi-bin/wireless.cgi endpoint. Public exploit code exists for this vulnerability, and no vendor patch is currently available. Affected devices running firmware versions up to 20210219 face risk of complete system compromise from authenticated network access.
Wl-Wn579A3 Firmware versions up to 20210219. contains a vulnerability that allows attackers to command injection (CVSS 6.3).
Command injection in Wavlink WL-WN579A3 firmware through the SSID2G2 parameter of /cgi-bin/wireless.cgi allows authenticated remote attackers to execute arbitrary commands with limited privileges. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor. The flaw affects confidentiality, integrity, and availability of affected devices.
Wavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A weakness has been identified in Wavlink NU516U1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. Rated medium severity (CVSS 5.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Wavlink NU516U1 M16U1_V240425. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Wavlink NU516U1 M16U1_V240425. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Wavlink WL-NU516U1 240425. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was detected in Wavlink WL-WN578W2 221110. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A security vulnerability has been detected in Wavlink WL-WN578W2 221110. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was identified in Wavlink WL-WN578W2 221110. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Wavlink WL-WN578W2 221110. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in Wavlink WL-WN578W2 221110. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in Wavlink WL-WN578W2 221110. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A flaw has been found in Wavlink WL-WN578W2 221110. Rated medium severity (CVSS 5.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the username parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_cmd function via the command parameter. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Wavlink AC1200 with firmware versions M32A3_V1410_230602 and M32A3_V1410_240222 are vulnerable to a post-authentication command injection while resetting the password. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was determined in Wavlink WL-NU516U1 M16U1_V240425. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
CVE-2025-50756 is a critical unauthenticated command injection vulnerability in the Wavlink WN535K3 router (firmware version 20191010) affecting the set_sys_adm function's newpass parameter. An unauthenticated remote attacker can execute arbitrary system commands with root privileges by sending a crafted request, enabling complete device compromise including data theft, malware installation, and lateral network movement. The CVSS 9.8 score reflects maximum severity; KEV status and active exploitation likelihood are elevated given the high exploitability characteristics (network-accessible, no authentication required, low attack complexity).
A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 13.0%.
A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 13.0%.
A command injection vulnerability in the component /cgi-bin/qos.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 13.0%.
Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.cgi via the pingIp parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple buffer overflow vulnerabilities in Wavlink WL-WN575A3 RPT75A3.V4300, which are caused by not performing strict length checks on user-controlled data. Rated medium severity (CVSS 5.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.