WAVLINK vulnerabilities
We track 175 vulnerabilities in WAVLINK products across 60+ products. 175 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest WAVLINK vulnerabilities
- 7.2 High severity
Wavlink AC3000: Buffer Copy without Checking Size of Input
An arbitrary code execution vulnerability exists in the adm.cgi set_MeshAp() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigge
- 7.2 High severity
Wavlink AC3000: Improper Neutralization of Special Elements used in a Command
An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP reque
- 7.2 High severity
Wavlink AC3000: Improper Neutralization of Special Elements used in a Command
An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger th
- 7.2 High severity
Wavlink AC3000: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability exists in the wireless.cgi DeleteMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request
- 7.2 High severity
Wavlink AC3000: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in the adm.cgi set_wzap() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this vu
- 7.2 High severity
Wavlink AC3000: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability exists in the wireless.cgi SetName() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to
- 7.2 High severity
Wavlink AC3000: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in the qos.cgi qos_sta_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger
- 7.2 High severity
Wavlink AC3000: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in the adm.cgi set_wzdgw4G() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this
- 7.2 High severity
Wavlink AC3000: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to tri
- 9.1 Critical severity
Wavlink AC3000: External Control of System or Configuration Setting
An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to tri
- 8.1 High severity
Wavlink AC3000: Missing Authentication for Critical Functionality
A firmware update vulnerability exists in the fw_check.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary firmware update. An attacker can perform a man-in-the-middle attack to trigger this vulnerabili
- 9.1 Critical severity
Wavlink AC3000: External Control of System or Configuration Setting
An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP r
- 7.2 High severity
Wavlink AC3000: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this v
- 7.2 High severity
Wavlink AC3000: Improper Neutralization of Special Elements used in a Command
An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger
- 7.2 High severity
Wavlink AC3000: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in the adm.cgi rep_as_bridge() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger th
- 7.2 High severity
Wavlink AC3000: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP req
- 7.2 High severity
Wavlink AC3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A command execution vulnerability exists in the qos.cgi qos_sta() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this v
- 9.8 Critical severity
Wavlink AC3000: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in the login.cgi Goto_chidx() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an unauthenticated HTTP request to trigger t
- 7.2 High severity
Wavlink AC3000: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in the usbip.cgi set_info() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger this
- 9.8 Critical severity
Wavlink AC3000: Stack-based Buffer Overflow
A stack-based buffer overflow vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send an HTTP request to trig
- 7.2 High severity
Wavlink AC3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A command injection vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger th
- 9.8 Critical severity
Wavlink AC3000: Improper Neutralization of Special Elements used in a Command
An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of HTTP requests can lead to arbitrary code execution. An attacker can send an HTTP request to tr
- 7.2 High severity
Wavlink AC3000: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A command execution vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this
- 7.2 High severity
WN530H4: Improper Neutralization of Special Elements used in a Command
A vulnerability classified as critical has been found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. Affected is the function set_ipv6 of the file internet.cgi. The manipulation of the argument IPv6OpMode/IPv6IPAddr/IPv6WANIPAddr/IPv6GWAddr leads to
- 7.2 High severity
WN530H4: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been rated as critical. This issue affects the function set_ipv6 of the file firewall.cgi. The manipulation of the argument dhcpGateway leads to command injection. The a
- 8.8 High severity
WN530H4: Out-of-bounds Write
A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been classified as critical. Affected is the function Goto_chidx of the file login.cgi of the component Front-End Authentication Page. The manipulation of the argument w
- 7.2 High severity
WN530H4: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028 and classified as critical. This issue affects the function ping_ddns of the file internet.cgi. The manipulation of the argument DDNS leads to command injection. The attack may
- 9.8 Critical severity
wl_wnj575a3: Improper Neutralization of Special Elements used in a Command
An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via username parameter of the set_sys_adm function in adm.cgi.
- 7.2 High severity
WL-WN531AX2: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS commands with the root privilege.
- 7.2 High severity
WL-WN531AX2: Unrestricted Upload of File with Dangerous Type
WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege.
- 8.1 High severity
WL-WN531AX2: Exposure of Resource to Wrong Sphere
Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attacker to use functions originally available after login without logging in.
- 7.2 High severity
WL-WN531AX2: Reliance on Cookies without Validation and Integrity Checking
Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrative privilege to execute OS commands with the root privilege.
- 9.8 Critical severity
WN579X3: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability classified as critical has been found in Wavlink WN579X3 up to 20230615. Affected is an unknown function of the file /cgi-bin/adm.cgi of the component Ping Test. The manipulation of the argument pingIp leads to injection. It is possible to laun
- 7.5 High severity
Wl-wn530hg4 Firmware: Missing Authorization
An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.
- 7.5 High severity
Wl-wn531g3 Firmware: Files or Directories Accessible to External Parties
WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated attackers to download configuration data and log files.
- 8.8 High severity
WN531G3: Cross-Site Request Forgery
The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 does not utilize anti-CSRF tokens, which, when combined with other issues (such as CVE-2022-35518), can lead to remote, unauthenticated command execution.
- 8.8 High severity
WN531G3: Improper Authentication
The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore, if an attacker changes their IP address to match the logged-in administrator's, or is behind the sa
- 7.5 High severity
WN531G3: Authentication Bypass by Capture-replay
Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing mechanism does not rely on a server-supplied key, it is possible for an attacker with sufficient net
- 9.8 Critical severity
Wl-wn575a3 Firmware: Improper Neutralization of Special Elements used in an OS Command
WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the file adm.cgi. This vulnerability allows attackers to execute arbitrary commands via the username parameter.
- 9.8 Critical severity
Wn572hp3 Firmware: Improper Neutralization of Special Elements used in a Command
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 nas.cgi has no filtering on parameters: User1Passwd and User1, which leads to command injection in page /nas_disk.shtml.