9
CVEs
2
Critical
3
High
0
KEV
5
PoC
2
Unpatched C/H
77.8%
Patch Rate
0.9%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
3
MEDIUM
1
LOW
3
Monthly CVE Trend
Affected Products (30)
Wl Wn533A8 Firmware
62
Wn530H4 Firmware
27
Wn535G3 Firmware
23
Wn533A8 Firmware
20
Wl Nu516u1 Firmware
18
Wn531P3 Firmware
17
Wn572Hp3 Firmware
16
Nu516U1
9
Wl Wn579a3 Firmware
8
Wl Wn575A3 Firmware
7
Wl Wn530Hg4 Firmware
7
Wl Nu516U1
7
Wn551K1 Firmware
7
Wl Wn578W2 Firmware
7
Wn530Hg4 Firmware
6
Wn572Hg3 Firmware
6
Wn531G3 Firmware
6
Wl Wn535K3 Firmware
5
Wl Wn531Ax2 Firmware
5
Wifi Repeater Firmware
5
Wn579X3 Firmware
4
Wl Wn535K2 Firmware
3
Aerial X 1200M Firmware
3
Wl Wn578w2
3
Wl Wn579G3 Firmware
3
Wl Wn579x3 C Firmware
2
Wl Wn570Ha1
2
Wl Nu516U1 A
2
Wn57X93 Firmware
2
Jetstream Erac3000 Firmware
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-74843 | Remote code execution in Wavlink WN531P3 and WN535M1 (firmware V250922) consumer routers arises from an unsafe strcpy in the export_pingortrace.cgi binary, where the attacker-controlled HTTP_COOKIE header is copied into a fixed stack buffer without bounds checking. Unauthenticated remote attackers can send a crafted Cookie header to the device web interface to overflow the stack and hijack execution. Publicly available exploit code exists (disclosed via VulDB with a PoC report), but there is no public exploit identified as actively exploited in the wild, and no CISA KEV listing. | CRITICAL | 9.3 | 1.0% | 67 |
PoC
No patch
|
| CVE-2026-13539 | Stack-based buffer overflow in the Wavlink WL-NU516U1-A wireless range extender (firmware M16U1_V240425) lets a remote, low-privileged attacker corrupt memory by sending an oversized Guest_ssid POST parameter to the sub_407504 function in /cgi-bin/wireless.cgi. The flaw was reported by VulDB, publicly available exploit code exists, and it carries a CVSS 4.0 base score of 7.4; there is no evidence of active exploitation in CISA KEV at this time. | HIGH | 7.4 | 0.5% | 57 |
PoC
|
| CVE-2026-18607 | Stack-based buffer overflow in Wavlink's lighttpd-based web interface allows network-adjacent authenticated attackers to achieve arbitrary code execution on at least thirteen SOHO router and range-extender models running firmware through 20260609. The vulnerable code path is the strcpy call within upload.cgi, which copies the HTTP_COOKIE request header into a fixed-size stack buffer without length validation. Publicly available exploit code exists on GitHub (0xcc12138/WAVLINK-vul); no CISA KEV listing is present, but the disclosed POC materially lowers the exploitation barrier for opportunistic actors targeting consumer networking gear. | HIGH | 7.4 | 0.4% | 57 |
PoC
No patch
|
| CVE-2026-18588 | Stack-based buffer overflow in the Wavlink WL-NU516U1 (firmware 708c073-mt7628) router's nas.cgi handler lets remote unauthenticated attackers overflow a fixed-size stack buffer by manipulating the HTTP CONTENT_LENGTH value processed via fgets. Successful exploitation can crash the device or execute arbitrary code with full compromise of confidentiality, integrity, and availability. A public write-up (GitHub report2.md) exists, but the flaw is not listed in CISA KEV - no public weaponized exploit is confirmed at time of analysis. | CRITICAL | 9.3 | 0.6% | 47 |
|
| CVE-2026-18589 | Stack-based buffer overflow in the Wavlink WL-NU516U1 NAS device's nas.cgi password change handler allows remote unauthenticated attackers to potentially execute arbitrary code by supplying an oversized User1Passwd argument to the change_password function. Affecting the MT7628 firmware variant (708c073-mt7628), this carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact and no privileges or user interaction required. A public proof-of-concept has been published and a vendor-released firmware patch is available as of 2026-07-13; no confirmed CISA KEV listing at time of analysis. | HIGH | 8.9 | 0.6% | 45 |
|
| CVE-2026-18587 | OS command injection in the Wavlink WL-NU516U1 firmware (build 708c073-mt7628) allows remote attackers to execute arbitrary operating system commands by supplying a crafted Password argument to the Config Import component. The CVSS 4.0 score of 7.7 reflects meaningful constraints - high attack complexity (AC:H) and required user interaction (UI:P) - yet the full confidentiality, integrity, and availability impact on the vulnerable system remains high. A proof-of-concept exploit has been publicly published on GitHub, and the vendor has already released a patched firmware binary, making this a time-sensitive patching priority for any deployment of the affected firmware build. | MEDIUM | 6.8 | 1.3% | 35 |
|
| CVE-2026-13538 | Command injection in Wavlink WL-NU516U1-A router firmware (M16U1_V240425) allows authenticated remote attackers to execute arbitrary OS commands by submitting crafted POST parameters to the wireless CGI configuration handler. The affected function sub_401D68 within /cgi-bin/wireless.cgi fails to sanitize the SSID2G2, SSID5G2, AuthMethod2, and WPAPSK12 parameters before passing them to OS-level commands. A public proof-of-concept exploit is confirmed available on GitHub; this CVE is not currently listed in CISA's KEV catalog, but the vendor has already released a patched firmware. | LOW | 2.1 | 1.3% | 32 |
PoC
|
| CVE-2026-15513 | OS command injection in the Wavlink WL-NU516U1 router's CGI web administration interface allows authenticated network attackers to execute arbitrary operating system commands by injecting shell metacharacters into the lan_ip parameter of the adm.cgi endpoint. The wlink_uci_set_value function passes attacker-controlled input unsanitized into OS-level commands, enabling full compromise of the underlying Linux-based router OS. A public proof-of-concept exploit is available on GitHub (no public exploit identified at time of analysis for KEV), and the vendor has released a patched firmware as of June 22, 2026. | LOW | 2.1 | 1.4% | 30 |
PoC
|
| CVE-2026-18590 | OS command injection in the Wavlink WL-NU516U1 router's admin password handler allows a remote, low-privileged authenticated attacker to execute arbitrary operating system commands via the set_sys_adm function in adm.cgi. The affected firmware version is 708c073-mt7628, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the vendor has responded promptly and released a patched firmware dated 2026-07-13. | LOW | 2.1 | 1.1% | 12 |
|