Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 contains an OS command injection vulnerability in the sub_23B54 function of the ioos binary, which passes the unsanitized file_id parameter of /protocol.csp?opt=ovpn_file requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.
CVE-2026-110958 is a critical heap-based buffer overflow vulnerability in the Wavlink WN530HG4B device, specifically in an unknown function within the api.cgi file. The vulnerability allows remote attackers to exploit the flaw without authentication. The vendor has released a firmware update (version 2026-09-24-841a51c6d5_tclinux.bin) that addresses the issue by changing the command invocation method and adding input validation.
CVE-2026-110957 is a critical OS command injection vulnerability in the Wavlink WL-WN530BE2-A device firmware up to version M30BE2_V250604. The flaw exists in the login processing component, specifically in the api.cgi file's sub_12580 function, where manipulation of the REMOTE_ADDR argument allows remote attackers to execute arbitrary OS commands. The vendor has confirmed the issue and released a fixed firmware version 2026-09-24-841a51c6d5_tclinux.bin that mitigates the vulnerability by changing the command execution method and validating input. The vulnerability has a CVSS 4.0 score of 10.0, indicating critical severity. No known exploits are reported in the wild at this time.
CVE-2026-109110 is a critical OS command injection vulnerability in the Wavlink WL-WN592AX6 device, specifically affecting the wmapd Daemon's system function. This flaw allows remote attackers to execute arbitrary OS commands without any privileges or user interaction. The vulnerability is present in version 250422 of the device firmware. An exploit has been published, increasing the risk of exploitation. No patch or remediation information is currently available from the vendor.
CVE-2026-109109 is a critical stack-based buffer overflow vulnerability in the Wavlink WL-WN530BE1-A device, specifically in the strcpy function of /cgi-bin/ExportAllSettings.cgi. The flaw can be triggered remotely by manipulating the HTTP_COOKIE or X-Cmd argument, potentially allowing an attacker to execute arbitrary code. The vulnerability has a CVSS 4.0 score of 10, indicating maximum severity. Exploit code is publicly available, but no confirmed in-the-wild exploitation has been reported. The affected version is exactly 251117. No patch or remediation details are provided in the available data.
CVE-2026-109108 is a critical OS command injection vulnerability in the Wavlink WL-WN530BE1-A device, specifically in the popen function of /cgi-bin/uploadVpn.cgi. The vulnerability arises from improper handling of the 'Type' argument, allowing remote attackers to execute arbitrary OS commands. The vulnerability affects version 251117 of the product. The exploit has been publicly disclosed, but there are no known exploits in the wild at this time.
A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the sync_server daemon on TCP port 13136. The daemon interpolates attacker-controlled filename input containing shell metacharacters into a shell command string via sprintf() and passes it to system() without sanitization, enabling root-level command execution on the device.
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header without path canonicalization, allowing attackers to supply an absolute path and write arbitrary content to overwrite startup scripts or credential stores to achieve persistent system compromise.
A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTP_COOKIE can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
CVE-2026-18587 is a high-severity OS command injection vulnerability in the Wavlink WL-NU516U1 device, specifically in an unknown function of the Config Import component. The vulnerability arises from manipulation of the Password argument, allowing remote attackers to execute OS commands. Exploitation is considered difficult due to high complexity, but a public exploit exists. The vendor responded promptly and released a fixed version.
A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lan_ip results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A vulnerability was identified in Wavlink WL-NU516U1-A M16U1_V240425. The impacted element is the function sub_407504 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. Such manipulation of the argument Guest_ssid leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A vulnerability was determined in Wavlink WL-NU516U1-A M16U1_V240425. The affected element is the function sub_401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument AuthMethod/EncrypType results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlan_conf/Channel/skiplist/ieee_80211h leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. This vulnerability affects the function wzdap of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument EncrypType/wl_Pass is directly passed by the attacker/so we can control the EncrypType/wl_Pass results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-bin/adm.cgi. Such manipulation of the argument skiplist1/skiplist2 leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.