WAVLINK vulnerabilities
We track 175 vulnerabilities in WAVLINK products across 60+ products. 175 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest WAVLINK vulnerabilities
- 8.8 High severity
NU516U1: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. Affected is the function change_wifi_password of the file /cgi-bin/adm.cgi. The manipulation of the argument wl_channel/wl_Pass/EncrypType leads to os command injection. It is possible to initiat
- 9.8 Critical severity
WL-WN570HA1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Wavlink WL-WN570HA1 R70HA1 V1410_221110. This issue affects the function set_sys_adm of the file /cgi-bin/adm.cgi. This manipulation of the argument Username causes command injection. It is possible to initiate the attack remo
- 7.2 High severity
WL-WN530H4: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Wavlink WL-WN530H4 20220721. This vulnerability affects the function strcat/snprintf of the file /cgi-bin/internet.cgi. The manipulation results in os command injection. It is possible to launch the attack remotely. The exploit has
- 8.8 High severity
WL-WN579X3-C: Out-of-bounds Write
A vulnerability was determined in Wavlink WL-WN579X3-C 231124. This impacts the function sub_4019FC of the file /cgi-bin/firewall.cgi of the component UPNP Handler. Executing a manipulation of the argument UpnpEnabled can lead to stack-based buffer overflow. I
- 8.8 High severity
WL-NU516U1: Improper Restriction of Operations within the Bounds of a Memory Buffer
A weakness has been identified in Wavlink WL-NU516U1 260227. This vulnerability affects the function ftext of the file /cgi-bin/nas.cgi. This manipulation of the argument Content-Length causes stack-based buffer overflow. The attack can be initiated remotely.
- 9.8 Critical severity
WL-WN578W2: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Wavlink WL-WN578W2 221110. Impacted is the function Delete_Mac_list/SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Executing a manipulation can lead to command injection. It is possible to la
- 9.8 Critical severity
WL-WN579A3: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Wavlink WL-WN579A3 220323. This issue affects the function SetName/GuestWifi of the file /cgi-bin/wireless.cgi of the component POST Request Handler. Performing a manipulation results in command injection. It is possible to init
- 8.8 High severity
WL-WN579X3-C: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in Wavlink WL-WN579X3-C 231124. This affects the function sub_40139C of the file /cgi-bin/firewall.cgi. Performing a manipulation of the argument del_flag results in stack-based buffer overflow. It is possible to initiate the attack r
- 9.8 Critical severity
NU516U1: Improper Restriction of Operations within the Bounds of a Memory Buffer
A flaw has been found in Wavlink NU516U1 251208. This affects the function sub_401A10 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to out-of-bounds write. The attack may be performed from remote. The exploit has been
- 7.2 High severity
NU516U1: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Wavlink NU516U1 251208. This vulnerability affects the function sub_405B2C of the file /cgi-bin/firewall.cgi of the component Incomplete Fix CVE-2025-10959. The manipulation leads to command injection. It is possible to initia
- 7.2 High severity
WL-NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Wavlink WL-NU516U1 240425. This vulnerability affects the function usb_p910 of the file /cgi-bin/adm.cgi. Such manipulation of the argument Pr_mode leads to command injection. It is possible to launch the attack remotely. The
- 7.2 High severity
WL-NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Wavlink WL-NU516U1 240425. This affects the function ota_new_upgrade of the file /cgi-bin/adm.cgi. This manipulation of the argument model causes command injection. It is possible to initiate the attack remotely. The exploit has been p
- 7.2 High severity
WL-NU516U1: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in Wavlink WL-NU516U1 V240425. This vulnerability affects the function sub_401A0C of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to stack-based buffer overflow. It is possible to launch the attack
- 7.2 High severity
WL-NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Wavlink WL-NU516U1 V240425. This affects the function sub_405AF4 of the file /cgi-bin/adm.cgi of the component OTA Online Upgrade. This manipulation of the argument firmware_url causes command injection. It is possible to init
- 7.2 High severity
WL-NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Wavlink WL-NU516U1 up to 20251208. The affected element is the function singlePortForwardDelete of the file /cgi-bin/firewall.cgi. Executing a manipulation of the argument del_flag can lead to command injection. The attack may be launc
- 7.2 High severity
WL-NU516U1: Out-of-bounds Write
A vulnerability was detected in Wavlink WL-NU516U1 20251208. This vulnerability affects the function sub_401218 of the file /cgi-bin/nas.cgi. Performing a manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack may be initia
- 7.2 High severity
WL-NU516U1: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security vulnerability has been detected in Wavlink WL-NU516U1 up to 130/260. This affects the function sub_406194 of the file /cgi-bin/adm.cgi. Such manipulation of the argument firmware_url leads to stack-based buffer overflow. The attack can be launched r
- 8.8 High severity
WL-WN579A3: Improper Neutralization of Special Elements used in a Command
A weakness has been identified in Wavlink WL-WN579A3 up to 20210219. This affects the function AddMac of the file /cgi-bin/wireless.cgi. This manipulation of the argument macAddr causes command injection. The attack is possible to be carried out remotely. The
- 9.8 Critical severity
WL-WN579A3: Improper Neutralization of Special Elements used in a Command
A security flaw has been discovered in Wavlink WL-WN579A3 up to 20210219. Affected by this issue is the function DeleteMac of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list results in command injection. The attack can be executed
- 9.8 Critical severity
WL-WN579A3: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in Wavlink WL-WN579A3 up to 20210219. Affected by this vulnerability is the function Delete_Mac_list of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list leads to command injection. Remote exploitation
- 9.8 Critical severity
WL-WN579A3: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in Wavlink WL-WN579A3 up to 20210219. Affected is an unknown function of the file /cgi-bin/login.cgi. Executing a manipulation of the argument key can lead to command injection. The attack may be launched remotely. The exploit ha
- 8.8 High severity
WL-WN579A3: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Wavlink WL-WN579A3 up to 20210219. This impacts the function multi_ssid of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument SSID2G2 results in command injection. The attack may be initiated remotely. The ex
- 8.8 High severity
Wl-wn586x3a Firmware: Buffer Copy without Checking Size of Input
Wavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file. The vulnerability arises because the Cookie parameter does not properly validate the length of input data. Attackers can exploit this to execute arbitra
- 8.8 High severity
NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Wavlink NU516U1. Affected by this vulnerability is the function sub_401B30 of the file /cgi-bin/firewall.cgi. This manipulation of the argument remoteManagementEnabled causes command injection. The attack can be initiated remo
- 8.8 High severity
NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. Affected is the function sub_4016F0 of the file /cgi-bin/firewall.cgi. The manipulation of the argument del_flag results in command injection. It is possible to launch the attack remotely. T
- 8.8 High severity
NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This impacts the function sub_403198 of the file /cgi-bin/wireless.cgi of the component SetName Page. The manipulation of the argument mac_5g leads to command injection. It is possible to initiat
- 8.0 High severity
NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. This affects the function sub_4030C0 of the file /cgi-bin/wireless.cgi of the component Delete_Mac_list Page. Executing manipulation of the argument delete_list can lead to command injection. The
- 8.8 High severity
NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Wavlink NU516U1 M16U1_V240425. The impacted element is the function sub_402D1C of the file /cgi-bin/wireless.cgi of the component DeleteMac Page. Performing manipulation of the argument delete_list results in command injection. The
- 8.8 High severity
NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. The affected element is the function sub_401778 of the file /cgi-bin/firewall.cgi. Such manipulation of the argument dmz_flag leads to command injection. The attack can be executed remotely. The
- 8.8 High severity
NU516U1: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Wavlink NU516U1 M16U1_V240425. Impacted is the function sub_403010 of the file /cgi-bin/wireless.cgi of the component AddMac Page. This manipulation of the argument macAddr causes command injection. Remote exploitation of the attack is
- 7.2 High severity
WL-NU516U1: Improper Neutralization of Special Elements used in a Command
A security vulnerability has been detected in Wavlink WL-NU516U1 240425. This vulnerability affects the function sub_4012A0 of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to os command injection. It is possible to launch the att
- 9.8 Critical severity
WL-WN578W2: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was detected in Wavlink WL-WN578W2 221110. This impacts the function sub_404DBC of the file /cgi-bin/wireless.cgi. The manipulation of the argument macAddr results in os command injection. The attack can be launched remotely. The exploit is now
- 9.8 Critical severity
WL-WN578W2: Improper Neutralization of Special Elements used in an OS Command
A security vulnerability has been detected in Wavlink WL-WN578W2 221110. This affects the function sub_404850 of the file /cgi-bin/wireless.cgi. The manipulation of the argument delete_list leads to os command injection. The attack can be initiated remotely. T
- 8.8 High severity
WL-WN578W2: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in Wavlink WL-WN578W2 221110. This impacts the function sub_401340/sub_401BA4 of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to command injection. It is possible to launch the attack remotely. The
- 9.8 Critical severity
WL-WN578W2: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects the function sub_401C5C of the file firewall.cgi. This manipulation of the argument pingFrmWANFilterEnabled/blockSynFloodEnabled/blockPortScanEnabled/remoteManagementEnabled causes comma
- 9.8 Critical severity
WL-WN578W2: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Wavlink WL-WN578W2 221110. The impacted element is the function sub_409184 of the file /wizard_rep.shtml. The manipulation of the argument sel_EncrypTyp results in command injection. The attack may be performed from remote. The exp
- 9.8 Critical severity
WL-NU516U1: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in Wavlink WL-NU516U1 M16U1_V240425. This impacts the function sub_4032E4 of the file /cgi-bin/wireless.cgi. This manipulation of the argument Guest_ssid causes command injection. The attack is possible to be carried out remotely
- 9.8 Critical severity
Wn535k3 Firmware: Improper Neutralization of Special Elements used in a Command
Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the newpass parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
- 9.8 Critical severity
QUANTUM D2G: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was found in WAVLINK QUANTUM D2G, QUANTUM D3G, WL-WN530G3A, WL-WN530HG3, WL-WN532A3 and WL-WN576K1 up to V1410_240222 and classified as critical. Affected by this issue is the function sys_login of the file /cgi-bin/login.cgi of the component H
- 9.8 Critical severity
Wl-wn579a3 Firmware: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted input.