WAVLINK vulnerabilities
We track 175 vulnerabilities in WAVLINK products across 60+ products. 175 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest WAVLINK vulnerabilities
- 8.0 High severity
Wifi-repeater Firmware: Direct Request
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system key information and execute arbitrary commands via accessing the page syslog.shtml.
- 7.5 High severity
Wl-wn579x3 Firmware: Direct Request
WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the messages.txt page.
- 7.5 High severity
Wl-wn530hg4 Firmware: Exposure of Resource to Wrong Sphere
An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd].
- 7.5 High severity
Wn533a8 Firmware: Incorrect Authorization
An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);].
- 9.8 Critical severity
Wl-wn530hg4 Firmware: Use of Hard-coded Credentials
Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etc_ro/lighttpd/www/cgi-bin/ExportAllSettings.sh.
- 9.8 Critical severity
WN535K2: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_sync.cgi. The manipulation of the argument IP leads to os command injection. The exploit has been dis
- 9.8 Critical severity
WN535K2: Improper Neutralization of Special Elements used in an OS Command
A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled.cgi. The manipulation of the argument start_hour leads to os command injection. The exploit has been
- 9.8 Critical severity
WN535K2: Improper Neutralization of Special Elements used in an OS Command
A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade. The manipulation of the argument key leads to os command injection. The exploit has been discl
- 9.8 Critical severity
Wl-wn575a3 Firmware: Improper Neutralization of Special Elements used in a Command
Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers to execute arbitrary commands via a crafted POST request.
- 7.5 High severity
Wn579x3 Firmware: Direct Request
A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensitive router information via a crafted POST request.
- 7.5 High severity
Wn535g3 Firmware: Exposure of Resource to Wrong Sphere
A vulnerability in live_mfg.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.
- 7.5 High severity
Wn535g3 Firmware: Exposure of Resource to Wrong Sphere
A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.
- 7.5 High severity
Aerial X 1200m Firmware: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in live_check.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to obtain sensitive router information via execution of the exec cmd function.
- 7.5 High severity
Aerial X 1200m Firmware: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability in live_mfg.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.191012 allows attackers to obtain sensitive router information via execution of the exec cmd function.
- 9.8 Critical severity
Wl-wn531p3 Firmware: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an attacker to achieve unauthorized remote code execution via a malicious POST request through /cgi-bin/adm.cgi.