26
CVEs
2
Critical
5
High
0
KEV
20
PoC
3
Unpatched C/H
34.6%
Patch Rate
0.7%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
5
MEDIUM
2
LOW
17
Monthly CVE Trend
Affected Products (30)
Wl Wn533A8 Firmware
62
Wn530H4 Firmware
27
Wn535G3 Firmware
23
Wn533A8 Firmware
20
Wl Nu516u1 Firmware
18
Wn531P3 Firmware
17
Wn572Hp3 Firmware
16
Nu516U1
9
Wl Wn579a3 Firmware
8
Wl Wn575A3 Firmware
7
Wl Wn530Hg4 Firmware
7
Wl Nu516U1
7
Wn551K1 Firmware
7
Wl Wn578W2 Firmware
7
Wn530Hg4 Firmware
6
Wn572Hg3 Firmware
6
Wn531G3 Firmware
6
Wl Wn535K3 Firmware
5
Wl Wn531Ax2 Firmware
5
Wifi Repeater Firmware
5
Wn579X3 Firmware
4
Wl Wn535K2 Firmware
3
Aerial X 1200M Firmware
3
Wl Wn578w2
3
Wl Wn579G3 Firmware
3
Wl Wn579x3 C Firmware
2
Wl Wn570Ha1
2
Wl Nu516U1 A
2
Wn57X93 Firmware
2
Jetstream Erac3000 Firmware
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-74843 | Remote code execution in Wavlink WN531P3 and WN535M1 (firmware V250922) consumer routers arises from an unsafe strcpy in the export_pingortrace.cgi binary, where the attacker-controlled HTTP_COOKIE header is copied into a fixed stack buffer without bounds checking. Unauthenticated remote attackers can send a crafted Cookie header to the device web interface to overflow the stack and hijack execution. Publicly available exploit code exists (disclosed via VulDB with a PoC report), but there is no public exploit identified as actively exploited in the wild, and no CISA KEV listing. | CRITICAL | 9.3 | 1.0% | 67 |
PoC
No patch
|
| CVE-2026-13539 | Stack-based buffer overflow in the Wavlink WL-NU516U1-A wireless range extender (firmware M16U1_V240425) lets a remote, low-privileged attacker corrupt memory by sending an oversized Guest_ssid POST parameter to the sub_407504 function in /cgi-bin/wireless.cgi. The flaw was reported by VulDB, publicly available exploit code exists, and it carries a CVSS 4.0 base score of 7.4; there is no evidence of active exploitation in CISA KEV at this time. | HIGH | 7.4 | 0.5% | 57 |
PoC
|
| CVE-2026-18607 | Stack-based buffer overflow in Wavlink's lighttpd-based web interface allows network-adjacent authenticated attackers to achieve arbitrary code execution on at least thirteen SOHO router and range-extender models running firmware through 20260609. The vulnerable code path is the strcpy call within upload.cgi, which copies the HTTP_COOKIE request header into a fixed-size stack buffer without length validation. Publicly available exploit code exists on GitHub (0xcc12138/WAVLINK-vul); no CISA KEV listing is present, but the disclosed POC materially lowers the exploitation barrier for opportunistic actors targeting consumer networking gear. | HIGH | 7.4 | 0.4% | 57 |
PoC
No patch
|
| CVE-2026-4861 | Remote attackers can exploit a stack-based buffer overflow in the /cgi-bin/nas.cgi endpoint of Wavlink WL-NU516U1 by manipulating the Content-Length parameter to achieve unauthenticated remote code execution. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. Authentication is required to trigger the flaw, limiting exposure to authenticated users or those with network access to the device. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-6483 | OS command injection in Wavlink WL-WN530H4 router's internet.cgi endpoint allows authenticated attackers with high privileges to execute arbitrary system commands remotely. The vulnerability, affecting firmware version 20220721, resides in unsafe use of strcat/snprintf functions handling user input. Public exploit code exists (EPSS risk elevated by POC availability), though exploitation requires administrative credentials (PR:H), limiting automated mass exploitation. Vendor-released firmware patch 2026.04.16 available. | HIGH | 7.3 | 0.1% | 57 |
PoC
|
| CVE-2026-18588 | Stack-based buffer overflow in the Wavlink WL-NU516U1 (firmware 708c073-mt7628) router's nas.cgi handler lets remote unauthenticated attackers overflow a fixed-size stack buffer by manipulating the HTTP CONTENT_LENGTH value processed via fgets. Successful exploitation can crash the device or execute arbitrary code with full compromise of confidentiality, integrity, and availability. A public write-up (GitHub report2.md) exists, but the flaw is not listed in CISA KEV - no public weaponized exploit is confirmed at time of analysis. | CRITICAL | 9.3 | 0.6% | 47 |
|
| CVE-2026-18589 | Stack-based buffer overflow in the Wavlink WL-NU516U1 NAS device's nas.cgi password change handler allows remote unauthenticated attackers to potentially execute arbitrary code by supplying an oversized User1Passwd argument to the change_password function. Affecting the MT7628 firmware variant (708c073-mt7628), this carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact and no privileges or user interaction required. A public proof-of-concept has been published and a vendor-released firmware patch is available as of 2026-07-13; no confirmed CISA KEV listing at time of analysis. | HIGH | 8.9 | 0.6% | 45 |
|
| CVE-2026-18587 | OS command injection in the Wavlink WL-NU516U1 firmware (build 708c073-mt7628) allows remote attackers to execute arbitrary operating system commands by supplying a crafted Password argument to the Config Import component. The CVSS 4.0 score of 7.7 reflects meaningful constraints - high attack complexity (AC:H) and required user interaction (UI:P) - yet the full confidentiality, integrity, and availability impact on the vulnerable system remains high. A proof-of-concept exploit has been publicly published on GitHub, and the vendor has already released a patched firmware binary, making this a time-sensitive patching priority for any deployment of the affected firmware build. | MEDIUM | 6.8 | 1.3% | 35 |
|
| CVE-2026-13538 | Command injection in Wavlink WL-NU516U1-A router firmware (M16U1_V240425) allows authenticated remote attackers to execute arbitrary OS commands by submitting crafted POST parameters to the wireless CGI configuration handler. The affected function sub_401D68 within /cgi-bin/wireless.cgi fails to sanitize the SSID2G2, SSID5G2, AuthMethod2, and WPAPSK12 parameters before passing them to OS-level commands. A public proof-of-concept exploit is confirmed available on GitHub; this CVE is not currently listed in CISA's KEV catalog, but the vendor has already released a patched firmware. | LOW | 2.1 | 1.3% | 32 |
PoC
|
| CVE-2026-7690 | Command injection in Wavlink WL-WN570HA1 firmware R70HA1 V1410_221110 allows authenticated remote attackers to execute arbitrary commands via the Username parameter in the set_sys_adm function of /cgi-bin/adm.cgi. Publicly available exploit code exists for this vulnerability affecting end-of-life hardware no longer supported by the vendor. | LOW | 2.1 | 0.8% | 31 |
PoC
No patch
|
| CVE-2026-7691 | Command injection in Wavlink WL-WN570HA1 firmware version R70HA1 V1410_221110 allows authenticated remote attackers to execute arbitrary system commands via manipulation of the command argument in the set_sys_cmd function of /cgi-bin/adm.cgi. The vulnerability has publicly available exploit code and affects only discontinued products no longer maintained by the vendor. | LOW | 2.1 | 0.8% | 31 |
PoC
No patch
|
| CVE-2026-8188 | OS command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated remote attackers to execute arbitrary commands via the change_wifi_password function in /cgi-bin/adm.cgi by manipulating the wl_channel, wl_Pass, or EncrypType parameters. Publicly available exploit code exists, and the vendor has been notified of the vulnerability. | LOW | 2.1 | 0.8% | 31 |
PoC
No patch
|
| CVE-2026-8189 | Remote authenticated command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated attackers to execute arbitrary OS commands via manipulation of wlan_bssid, sel_Automode, or sel_EncrypTyp parameters in the wzdrepeater function at /cgi-bin/adm.cgi. CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P) with public exploit code available; vendor was notified early of this disclosure. | LOW | 2.1 | 0.8% | 31 |
PoC
No patch
|
| CVE-2026-8190 | OS command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated remote attackers to execute arbitrary system commands via unsanitized WAN configuration parameters (ppp_username, ppp_passwd, rwan_ip, rwan_mask, rwan_gateway) in the /cgi-bin/adm.cgi wan function. Publicly available exploit code exists and the vendor has been notified. | LOW | 2.1 | 0.8% | 31 |
PoC
No patch
|
| CVE-2026-8191 | Remote OS command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated remote attackers to execute arbitrary system commands via the skiplist1/skiplist2 parameters in the wifi_region function of /cgi-bin/adm.cgi. The vulnerability is remotely exploitable with low complexity, affects confidentiality and integrity, and has publicly available exploit code. | LOW | 2.1 | 0.8% | 31 |
PoC
No patch
|