A vulnerability has been found in WAVLINK WN551X3-A M51X3V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument groupname leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

A vulnerability was found in WAVLINK WN551X3-A M51X3V251020-WO-182e965. This impacts the function sub41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function hostblack of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpncli Handler. Executing a manipulation of the argument fileid can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpnip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

A vulnerability was detected in WAVLINK WN536AX6-A V2605072.0.0. Impacted is the function sub416d48/sub41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguardcligroup handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument groupid/groupname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

A security vulnerability has been detected in WAVLINK WN536AX6-A V2605072.0.0. This issue affects the function sub41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument groupname leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

A weakness has been identified in WAVLINK WN536AX6-A V2605072.0.0. This vulnerability affects the function sub416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument groupname causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

A vulnerability was determined in WAVLINK WN553X1-B V2604032.0.0. This issue affects the function sub41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument groupid/groupname can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

A vulnerability was found in WAVLINK WN553X1-B V2604032.0.0. This vulnerability affects the function sub419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument fileid results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

A vulnerability has been found in WAVLINK WN553X1-B 2604032.0.0. This affects the function sub4162A8 of the file /bin/ioos of the component ovpnfile Handler. Such manipulation of the argument fileid leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

A vulnerability was determined in WAVLINK WN553X1-B V2604032.0.0. The affected element is the function sub416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument fileid causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

A vulnerability has been found in WAVLINK WN553X1-B 2604032.0.0. This issue affects the function sub416B50 of the file /bin/ioos. The manipulation of the argument fileid leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

A flaw has been found in WAVLINK WN553X1-B V2604032.0.0. This vulnerability affects the function sub416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument groupid/groupname can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function delvlangroup of the component ioos Web Backend. The manipulation of the argument vlanname results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

A vulnerability was detected in WAVLINK WN701AE M01AEV260105. This affects the function delstaticrule of the file staticroutesetting.sh of the component ioos Web Backend. Performing a manipulation of the argument rulename results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function concheckreadfinish of the file /protocol.csp. Such manipulation of the argument groupname/IP-FROM leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

A flaw has been found in WAVLINK WL-WN530HG4B MV260724. This impacts the function portforward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function portforward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function setwzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wizard. The manipulation of the argument wlanssid leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Wavlink WL-WN530BE1-A firmware through M30BE1V251117 contains an OS command injection vulnerability in the sub23B54 function of the ioos binary, which passes the unsanitized fileid parameter of /protocol.csp?opt=ovpnfile requests with type=del to popen(). A remote unauthenticated attacker can send a forged IP-FROM: 127.0.0.1 header to bypass login and execute arbitrary commands as root.

A vulnerability was found in Wavlink WN530HG4B M30HG4BV260724. The impacted element is an unknown function of the file api.cgi. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026-09-24-841a51c6d5tclinux.bin is sufficient to resolve this issue. The affected component should be upgraded. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."

A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2V250604. The affected element is the function sub12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTEADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."

A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

A vulnerability was detected in Wavlink WL-WN530BE1-A 251117. This vulnerability affects the function strcpy of the file /cgi-bin/ExportAllSettings.cgi of the component Settings Export CGI. Performing a manipulation of the argument HTTPCOOKIE/X-Cmd results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted filenames to the syncserver daemon on TCP port 13136. The daemon interpolates attacker-controlled filename input containing shell metacharacters into a shell command string via sprintf() and passes it to system() without sanitization, enabling root-level command execution on the device.

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the syncserver daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header without path canonicalization, allowing attackers to supply an absolute path and write arbitrary content to overwrite startup scripts or credential stores to achieve persistent system compromise.