54
CVEs
3
Critical
13
High
0
KEV
48
PoC
10
Unpatched C/H
20.4%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
13
MEDIUM
5
LOW
33
Monthly CVE Trend
Affected Products (30)
Wl Wn533A8 Firmware
62
Wn530H4 Firmware
27
Wn535G3 Firmware
23
Wn533A8 Firmware
20
Wl Nu516u1 Firmware
18
Wn531P3 Firmware
17
Wn572Hp3 Firmware
16
Nu516U1
9
Wl Wn579a3 Firmware
8
Wl Wn575A3 Firmware
7
Wl Wn530Hg4 Firmware
7
Wl Nu516U1
7
Wn551K1 Firmware
7
Wl Wn578W2 Firmware
7
Wn530Hg4 Firmware
6
Wn572Hg3 Firmware
6
Wn531G3 Firmware
6
Wl Wn535K3 Firmware
5
Wl Wn531Ax2 Firmware
5
Wifi Repeater Firmware
5
Wn579X3 Firmware
4
Wl Wn535K2 Firmware
3
Aerial X 1200M Firmware
3
Wl Wn578w2
3
Wl Wn579G3 Firmware
3
Wl Wn579x3 C Firmware
2
Wl Wn570Ha1
2
Wl Nu516U1 A
2
Wn57X93 Firmware
2
Jetstream Erac3000 Firmware
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-3703 | Wavlink NU516U1 firmware 251208 has a buffer overflow enabling remote code execution through crafted HTTP requests to the CGI interface. | CRITICAL | 9.8 | 0.2% | 69 |
PoC
No patch
|
| CVE-2026-74843 | Remote code execution in Wavlink WN531P3 and WN535M1 (firmware V250922) consumer routers arises from an unsafe strcpy in the export_pingortrace.cgi binary, where the attacker-controlled HTTP_COOKIE header is copied into a fixed stack buffer without bounds checking. Unauthenticated remote attackers can send a crafted Cookie header to the device web interface to overflow the stack and hijack execution. Publicly available exploit code exists (disclosed via VulDB with a PoC report), but there is no public exploit identified as actively exploited in the wild, and no CISA KEV listing. | CRITICAL | 9.3 | 1.0% | 67 |
PoC
No patch
|
| CVE-2026-4164 | Critical command injection vulnerability in Wavlink WL-WN578W2 wireless routers (firmware version 221110) that allows unauthenticated remote attackers to execute arbitrary commands via specially crafted POST requests to multiple functions in the wireless.cgi script. A public proof-of-concept exploit is available on GitHub, and the vendor has released a patch, making this a high-priority issue for immediate remediation despite no current KEV listing. | HIGH | 8.9 | 0.2% | 65 |
PoC
|
| CVE-2026-4163 | Critical command injection vulnerability in Wavlink WL-WN579A3 wireless router firmware version 220323, allowing unauthenticated remote attackers to execute arbitrary commands via the SetName/GuestWifi functions in /cgi-bin/wireless.cgi. A public proof-of-concept exploit is available, and while a vendor patch exists, the vulnerability has not yet been added to CISA's KEV catalog despite its high severity (CVSS 9.8). | HIGH | 8.9 | 0.2% | 65 |
PoC
|
| CVE-2026-3715 | Remote code execution in Wavlink WL-WN579X3-C firmware through stack-based buffer overflow in the firewall.cgi module allows unauthenticated attackers to achieve complete system compromise via manipulation of the del_flag parameter. Public exploit code exists for this vulnerability, and no patch is currently available despite vendor notification. Affected users should immediately restrict network access to the affected device until a firmware update becomes available. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2025-55847 | Wavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. Rated high severity (CVSS 8.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 8.8 | 0.1% | 64 |
PoC
No patch
|
| CVE-2026-13539 | Stack-based buffer overflow in the Wavlink WL-NU516U1-A wireless range extender (firmware M16U1_V240425) lets a remote, low-privileged attacker corrupt memory by sending an oversized Guest_ssid POST parameter to the sub_407504 function in /cgi-bin/wireless.cgi. The flaw was reported by VulDB, publicly available exploit code exists, and it carries a CVSS 4.0 base score of 7.4; there is no evidence of active exploitation in CISA KEV at this time. | HIGH | 7.4 | 0.5% | 57 |
PoC
|
| CVE-2026-18607 | Stack-based buffer overflow in Wavlink's lighttpd-based web interface allows network-adjacent authenticated attackers to achieve arbitrary code execution on at least thirteen SOHO router and range-extender models running firmware through 20260609. The vulnerable code path is the strcpy call within upload.cgi, which copies the HTTP_COOKIE request header into a fixed-size stack buffer without length validation. Publicly available exploit code exists on GitHub (0xcc12138/WAVLINK-vul); no CISA KEV listing is present, but the disclosed POC materially lowers the exploitation barrier for opportunistic actors targeting consumer networking gear. | HIGH | 7.4 | 0.4% | 57 |
PoC
No patch
|
| CVE-2026-4861 | Remote attackers can exploit a stack-based buffer overflow in the /cgi-bin/nas.cgi endpoint of Wavlink WL-NU516U1 by manipulating the Content-Length parameter to achieve unauthenticated remote code execution. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. Authentication is required to trigger the flaw, limiting exposure to authenticated users or those with network access to the device. | HIGH | 7.4 | 0.0% | 57 |
PoC
No patch
|
| CVE-2026-6483 | OS command injection in Wavlink WL-WN530H4 router's internet.cgi endpoint allows authenticated attackers with high privileges to execute arbitrary system commands remotely. The vulnerability, affecting firmware version 20220721, resides in unsafe use of strcat/snprintf functions handling user input. Public exploit code exists (EPSS risk elevated by POC availability), though exploitation requires administrative credentials (PR:H), limiting automated mass exploitation. Vendor-released firmware patch 2026.04.16 available. | HIGH | 7.3 | 0.1% | 57 |
PoC
|
| CVE-2026-2615 | Wl-Nu516U1 Firmware versions up to 20251208. contains a vulnerability that allows attackers to command injection (CVSS 7.2). | HIGH | 7.2 | 0.4% | 56 |
PoC
No patch
|
| CVE-2026-3612 | Remote code execution in Wavlink WL-NU516U1 firmware allows unauthenticated attackers to execute arbitrary commands through the firmware_url parameter in the OTA upgrade function, requiring only high-level privileges to trigger. Public exploit code exists for this vulnerability and no patch is currently available, making it an immediate risk for affected devices. | HIGH | 7.2 | 0.4% | 56 |
PoC
No patch
|
| CVE-2026-2567 | Remote code execution in Wavlink WL-NU516U1 firmware through a stack-based buffer overflow in the nas.cgi User1Passwd parameter allows unauthenticated network attackers to achieve full system compromise. Public exploit code exists for this vulnerability, and no patch is currently available, leaving affected devices at immediate risk. | HIGH | 7.2 | 0.1% | 56 |
PoC
No patch
|
| CVE-2026-3613 | Stack-based buffer overflow in Wavlink WL-NU516U1 firmware's login.cgi allows remote attackers with high privileges to achieve complete system compromise through a malformed ipaddr parameter. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw enables unauthenticated remote code execution with full read, write, and execution capabilities on affected devices. | HIGH | 7.2 | 0.1% | 56 |
PoC
No patch
|
| CVE-2026-2565 | Stack overflow in Wavlink WL-NU516U1 firmware's /cgi-bin/adm.cgi allows remote attackers with high privileges to achieve code execution via a malicious time_zone parameter. Public exploit code exists for this vulnerability, though exploitation requires high complexity and the vendor has not released a patch. | MEDIUM | 6.6 | 0.0% | 53 |
PoC
No patch
|