# cve.now: Wavlink

The newest entries naming Wavlink as an affected vendor (up to 200), of 165 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120345](https://cve.now/CVE-2026-120345.md): WAVLINK WN551X3-A DNS Resolution ioos sub\_41a430 os command injection (CVSS 10.0)
- [CVE-2026-120344](https://cve.now/CVE-2026-120344.md): WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection (CVSS 10.0)
- [CVE-2026-120282](https://cve.now/CVE-2026-120282.md): WAVLINK WN536AX6-A protocol.csp host\_black os command injection (CVSS 9.4)
- [CVE-2026-120281](https://cve.now/CVE-2026-120281.md): WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow (CVSS 10.0)
- [CVE-2026-120280](https://cve.now/CVE-2026-120280.md): WAVLINK WN536AX6-A WireGuard protocol.csp wireguard\_cli\_group handler os command injection (CVSS 10.0)
- [CVE-2026-120279](https://cve.now/CVE-2026-120279.md): WAVLINK WN536AX6-A openvpn\_cli protocol.csp os command injection (CVSS 10.0)
- [CVE-2026-120278](https://cve.now/CVE-2026-120278.md): WAVLINK WN536AX6-A VPN Client List ioos sub\_41a7c0 missing authentication (CVSS 6.9)
- [CVE-2026-120277](https://cve.now/CVE-2026-120277.md): WAVLINK WN536AX6-A WireGuard CLI Group ioos sub\_41a1d8 os command injection (CVSS 10.0)
- [CVE-2026-120276](https://cve.now/CVE-2026-120276.md): WAVLINK WN536AX6-A Web Management ioos sub\_416760 os command injection (CVSS 10.0)
- [CVE-2026-120240](https://cve.now/CVE-2026-120240.md): WAVLINK WN553X1-B WireGuard CLI Group ioos sub\_41A748 os command injection (CVSS 9.4)
- [CVE-2026-120239](https://cve.now/CVE-2026-120239.md): WAVLINK WN553X1-B WireGuard CLI ioos sub\_419DA8 os command injection (CVSS 9.4)
- [CVE-2026-120238](https://cve.now/CVE-2026-120238.md): WAVLINK WN553X1-B ovpn\_file ioos sub\_4162A8 os command injection (CVSS 9.4)
- [CVE-2026-120231](https://cve.now/CVE-2026-120231.md): WAVLINK WN553X1-B OpenVPN CLI ioos sub\_416568 os command injection (CVSS 9.4)
- [CVE-2026-120230](https://cve.now/CVE-2026-120230.md): WAVLINK WN701AE ioos Web Backend del\_vlan\_group os command injection (CVSS 9.4)
- [CVE-2026-120229](https://cve.now/CVE-2026-120229.md): WAVLINK WN553X1-B ioos sub\_416B50 os command injection (CVSS 9.4)
- [CVE-2026-120228](https://cve.now/CVE-2026-120228.md): WAVLINK WN553X1-B ioos Service sub\_416D88 os command injection (CVSS 9.4)
- [CVE-2026-120227](https://cve.now/CVE-2026-120227.md): WAVLINK WN701AE ioos Web Backend static\_route\_setting.sh del\_staticrule os command injection (CVSS 9.4)
- [CVE-2026-120198](https://cve.now/CVE-2026-120198.md): WAVLINK WL-WN530BE1-A protocol.csp con\_check\_read\_finish command injection (CVSS 10.0)
- [CVE-2026-120197](https://cve.now/CVE-2026-120197.md): WAVLINK WL-WN530HG4B wapi.cgi port\_forward os command injection (CVSS 9.4)
- [CVE-2026-120196](https://cve.now/CVE-2026-120196.md): WAVLINK WN579X3-D wapi.cgi port\_forward os command injection (CVSS 9.4)
- [CVE-2026-120195](https://cve.now/CVE-2026-120195.md): WAVLINK WL-WN579A3-A Initial Setup Wizard adm.cgi set\_wzdgwMesh os command injection (CVSS 10.0)
- [CVE-2026-113802](https://cve.now/CVE-2026-113802.md): Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn\_file Handler (CVSS 9.3)
- [CVE-2026-110958](https://cve.now/CVE-2026-110958.md): Wavlink WN530HG4B api.cgi heap-based overflow (CVSS 10.0)
- [CVE-2026-110957](https://cve.now/CVE-2026-110957.md): Wavlink WL-WN530BE2-A Login Processing api.cgi sub\_12580 os command injection (CVSS 10.0)
- [CVE-2026-109110](https://cve.now/CVE-2026-109110.md): Wavlink WL-WN592AX6 wmapd system os command injection (CVSS 10.0)
- [CVE-2026-109109](https://cve.now/CVE-2026-109109.md): Wavlink WL-WN530BE1-A Settings Export CGI ExportAllSettings.cgi strcpy stack-based overflow (CVSS 10.0)
- [CVE-2026-109108](https://cve.now/CVE-2026-109108.md): Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection (CVSS 9.4)
- [CVE-2026-109107](https://cve.now/CVE-2026-109107.md): Wavlink WL-WN592AX6 upload.cgi main null pointer dereference (CVSS 6.9)
- [CVE-2026-74843](https://cve.now/CVE-2026-74843.md): Wavlink WN531P3/WN535M1 Export Pingortrace CGI export\_pingortrace.cgi strcpy stack-based overflow (CVSS 10.0)
- [CVE-2026-18607](https://cve.now/CVE-2026-18607.md): Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow (CVSS 8.7)
- [CVE-2026-18590](https://cve.now/CVE-2026-18590.md): Wavlink WL-NU516U1 Admin Password adm.cgi set\_sys\_adm os command injection (CVSS 5.3)
- [CVE-2026-18589](https://cve.now/CVE-2026-18589.md): Wavlink WL-NU516U1 nas.cgi change\_password stack-based overflow (CVSS 9.3)
- [CVE-2026-18588](https://cve.now/CVE-2026-18588.md): Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow (CVSS 9.3)
- [CVE-2026-18587](https://cve.now/CVE-2026-18587.md): Wavlink WL-NU516U1 Config Import os command injection (CVSS 7.7)
- [CVE-2026-15513](https://cve.now/CVE-2026-15513.md): Wavlink WL-NU516U1 adm.cgi wlink\_uci\_set\_value os command injection (CVSS 5.3)
- [CVE-2026-13539](https://cve.now/CVE-2026-13539.md): Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub\_407504 stack-based overflow (CVSS 8.7)
- [CVE-2026-13538](https://cve.now/CVE-2026-13538.md): Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub\_401D68 command injection (CVSS 5.3)
- [CVE-2026-8230](https://cve.now/CVE-2026-8230.md): Wavlink NU516U1 login.cgi sys\_login1 os command injection (CVSS 5.3)
- [CVE-2026-8229](https://cve.now/CVE-2026-8229.md): Wavlink NU516U1 wireless.cgi WifiBasic os command injection (CVSS 5.3)
- [CVE-2026-8228](https://cve.now/CVE-2026-8228.md): Wavlink NU516U1 wireless.cgi advance os command injection (CVSS 5.3)
- [CVE-2026-8227](https://cve.now/CVE-2026-8227.md): Wavlink NU516U1 adm.cgi wzdapMesh os command injection (CVSS 5.3)
- [CVE-2026-8192](https://cve.now/CVE-2026-8192.md): Wavlink NU516U1 adm.cgi wzdap os command injection (CVSS 5.3)
- [CVE-2026-8191](https://cve.now/CVE-2026-8191.md): Wavlink NU516U1 adm.cgi wifi\_region os command injection (CVSS 5.3)
- [CVE-2026-8190](https://cve.now/CVE-2026-8190.md): Wavlink NU516U1 adm.cgi wan os command injection (CVSS 5.3)
- [CVE-2026-8189](https://cve.now/CVE-2026-8189.md): Wavlink NU516U1 adm.cgi wzdrepeater os command injection (CVSS 5.3)
- [CVE-2026-8188](https://cve.now/CVE-2026-8188.md): Wavlink NU516U1 adm.cgi change\_wifi\_password os command injection (CVSS 5.3)
- [CVE-2026-7692](https://cve.now/CVE-2026-7692.md): Wavlink WL-WN570HA1 adm.cgi ping\_ddns command injection (CVSS 5.3)
- [CVE-2026-7691](https://cve.now/CVE-2026-7691.md): Wavlink WL-WN570HA1 adm.cgi set\_sys\_cmd command injection (CVSS 5.3)
- [CVE-2026-7690](https://cve.now/CVE-2026-7690.md): Wavlink WL-WN570HA1 adm.cgi set\_sys\_adm command injection (CVSS 5.3)
- [CVE-2026-6559](https://cve.now/CVE-2026-6559.md): Wavlink WL-WN579A3 login.cgi sub\_401F80 cross site scripting (CVSS 5.3)
- [CVE-2026-6483](https://cve.now/CVE-2026-6483.md): Wavlink WL-WN530H4 internet.cgi snprintf os command injection (CVSS 8.6)
- [CVE-2026-5004](https://cve.now/CVE-2026-5004.md): Wavlink WL-WN579X3-C UPNP firewall.cgi sub\_4019FC stack-based overflow (CVSS 8.7)
- [CVE-2026-4861](https://cve.now/CVE-2026-4861.md): Wavlink WL-NU516U1 nas.cgi ftext stack-based overflow (CVSS 8.7)
- [CVE-2026-4544](https://cve.now/CVE-2026-4544.md): Wavlink WL-WN578W2 POST Request login.cgi cross site scripting (CVSS 4.8)
- [CVE-2026-4543](https://cve.now/CVE-2026-4543.md): Wavlink WL-WN578W2 POST Request firewall.cgi command injection (CVSS 5.3)
- [CVE-2026-4166](https://cve.now/CVE-2026-4166.md): Wavlink WL-NU516U1 login.cgi sub\_404F68 cross site scripting (CVSS 5.1)
- [CVE-2026-4164](https://cve.now/CVE-2026-4164.md): Wavlink WL-WN578W2 POST Request wireless.cgi GuestWifi command injection (CVSS 9.3)
- [CVE-2026-4163](https://cve.now/CVE-2026-4163.md): Wavlink WL-WN579A3 POST Request wireless.cgi GuestWifi command injection (CVSS 9.3)
- [CVE-2026-3716](https://cve.now/CVE-2026-3716.md): Wavlink WL-WN579X3-C adm.cgi sub\_401AD4 cross site scripting (CVSS 4.8)
- [CVE-2026-3715](https://cve.now/CVE-2026-3715.md): Wavlink WL-WN579X3-C firewall.cgi sub\_40139C stack-based overflow (CVSS 8.7)
- [CVE-2026-3703](https://cve.now/CVE-2026-3703.md): Wavlink NU516U1 login.cgi sub\_401A10 out-of-bounds write (CVSS 9.3)
- [CVE-2026-3704](https://cve.now/CVE-2026-3704.md): Wavlink NU516U1 Incomplete Fix CVE-2025-10959 firewall.cgi sub\_405B2C command injection (CVSS 5.1)
- [CVE-2026-3662](https://cve.now/CVE-2026-3662.md): Wavlink WL-NU516U1 adm.cgi usb\_p910 command injection (CVSS 5.1)
- [CVE-2026-3661](https://cve.now/CVE-2026-3661.md): Wavlink WL-NU516U1 adm.cgi ota\_new\_upgrade command injection (CVSS 5.1)
- [CVE-2026-3613](https://cve.now/CVE-2026-3613.md): Wavlink WL-NU516U1 login.cgi sub\_401A0C stack-based overflow (CVSS 8.6)
- [CVE-2026-3612](https://cve.now/CVE-2026-3612.md): Wavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub\_405AF4 command injection (CVSS 8.6)
- [CVE-2026-2615](https://cve.now/CVE-2026-2615.md): Wavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injection (CVSS 8.6)
- [CVE-2026-2567](https://cve.now/CVE-2026-2567.md): Wavlink WL-NU516U1 nas.cgi sub\_401218 stack-based overflow (CVSS 8.6)
- [CVE-2026-2566](https://cve.now/CVE-2026-2566.md): Wavlink WL-NU516U1 adm.cgi sub\_406194 stack-based overflow (CVSS 8.6)
- [CVE-2026-2565](https://cve.now/CVE-2026-2565.md): Wavlink WL-NU516U1 adm.cgi sub\_40785C stack-based overflow (CVSS 7.5)
- [CVE-2026-2530](https://cve.now/CVE-2026-2530.md): Wavlink WL-WN579A3 wireless.cgi AddMac command injection (CVSS 5.3)
- [CVE-2026-2529](https://cve.now/CVE-2026-2529.md): Wavlink WL-WN579A3 wireless.cgi DeleteMac command injection (CVSS 5.3)
- [CVE-2026-2528](https://cve.now/CVE-2026-2528.md): Wavlink WL-WN579A3 wireless.cgi Delete\_Mac\_list command injection (CVSS 5.3)
- [CVE-2026-2527](https://cve.now/CVE-2026-2527.md): Wavlink WL-WN579A3 login.cgi command injection (CVSS 5.3)
- [CVE-2026-2526](https://cve.now/CVE-2026-2526.md): Wavlink WL-WN579A3 wireless.cgi multi\_ssid command injection (CVSS 5.3)
- [CVE-2025-10964](https://cve.now/CVE-2025-10964.md): Wavlink NU516U1 firewall.cgi sub\_401B30 command injection (CVSS 5.3)
- [CVE-2025-10963](https://cve.now/CVE-2025-10963.md): Wavlink NU516U1 firewall.cgi sub\_4016F0 command injection (CVSS 5.3)
- [CVE-2025-10962](https://cve.now/CVE-2025-10962.md): Wavlink NU516U1 SetName wireless.cgi sub\_403198 command injection (CVSS 5.3)
- [CVE-2025-10961](https://cve.now/CVE-2025-10961.md): Wavlink NU516U1 Delete\_Mac\_list wireless.cgi sub\_4030C0 command injection (CVSS 5.1)
- [CVE-2025-10960](https://cve.now/CVE-2025-10960.md): Wavlink NU516U1 DeleteMac wireless.cgi sub\_402D1C command injection (CVSS 5.3)
- [CVE-2025-10959](https://cve.now/CVE-2025-10959.md): Wavlink NU516U1 firewall.cgi sub\_401778 command injection (CVSS 5.3)
- [CVE-2025-10958](https://cve.now/CVE-2025-10958.md): Wavlink NU516U1 AddMac wireless.cgi sub\_403010 command injection (CVSS 5.3)
- [CVE-2025-10775](https://cve.now/CVE-2025-10775.md): Wavlink WL-NU516U1 login.cgi sub\_4012A0 os command injection (CVSS 5.1)
- [CVE-2025-10359](https://cve.now/CVE-2025-10359.md): Wavlink WL-WN578W2 wireless.cgi sub\_404DBC os command injection (CVSS 6.9)
- [CVE-2025-10358](https://cve.now/CVE-2025-10358.md): Wavlink WL-WN578W2 wireless.cgi sub\_404850 os command injection (CVSS 6.9)
- [CVE-2025-10325](https://cve.now/CVE-2025-10325.md): Wavlink WL-WN578W2 login.cgi sub\_401BA4 command injection (CVSS 5.3)
- [CVE-2025-10324](https://cve.now/CVE-2025-10324.md): Wavlink WL-WN578W2 firewall.cgi sub\_401C5C command injection (CVSS 6.9)
- [CVE-2025-10323](https://cve.now/CVE-2025-10323.md): Wavlink WL-WN578W2 wizard\_rep.shtml sub\_409184 command injection (CVSS 6.9)
- [CVE-2025-10322](https://cve.now/CVE-2025-10322.md): Wavlink WL-WN578W2 sysinit.html password recovery (CVSS 6.9)
- [CVE-2025-10321](https://cve.now/CVE-2025-10321.md): Wavlink WL-WN578W2 live\_online.shtml information disclosure (CVSS 6.9)
- [CVE-2025-9149](https://cve.now/CVE-2025-9149.md): Wavlink WL-NU516U1 wireless.cgi sub\_4032E4 command injection (CVSS 5.3)
- [CVE-2025-5408](https://cve.now/CVE-2025-5408.md): WAVLINK WL-WN576K1 HTTP POST Request login.cgi sys\_login buffer overflow (CVSS 9.3)
- [CVE-2024-34166](https://cve.now/CVE-2024-34166.md): An os command injection vulnerability exists in the touchlist\_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 10.0)
- [CVE-2024-39363](https://cve.now/CVE-2024-39363.md): A cross-site scripting (xss) vulnerability exists in the login.cgi set\_lang\_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505 (CVSS 9.6)
- [CVE-2024-39761](https://cve.now/CVE-2024-39761.md): Multiple OS command injection vulnerabilities exist in the login.cgi set\_sys\_init() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 10.0)
- [CVE-2024-39760](https://cve.now/CVE-2024-39760.md): Multiple OS command injection vulnerabilities exist in the login.cgi set\_sys\_init() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 10.0)
- [CVE-2024-39759](https://cve.now/CVE-2024-39759.md): Multiple OS command injection vulnerabilities exist in the login.cgi set\_sys\_init() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 10.0)
- [CVE-2024-36290](https://cve.now/CVE-2024-36290.md): A buffer overflow vulnerability exists in the login.cgi Goto\_chidx() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 10.0)
- [CVE-2024-39765](https://cve.now/CVE-2024-39765.md): Multiple OS command injection vulnerabilities exist in the internet.cgi set\_add\_routing() functionality of Wavlink AC3000 M33A8.V5030.210505 (CVSS 9.1)
- [CVE-2024-39764](https://cve.now/CVE-2024-39764.md): Multiple OS command injection vulnerabilities exist in the internet.cgi set\_add\_routing() functionality of Wavlink AC3000 M33A8.V5030.210505 (CVSS 9.1)
- [CVE-2024-39763](https://cve.now/CVE-2024-39763.md): Multiple OS command injection vulnerabilities exist in the internet.cgi set\_add\_routing() functionality of Wavlink AC3000 M33A8.V5030.210505 (CVSS 9.1)
- [CVE-2024-39762](https://cve.now/CVE-2024-39762.md): Multiple OS command injection vulnerabilities exist in the internet.cgi set\_add\_routing() functionality of Wavlink AC3000 M33A8.V5030.210505 (CVSS 9.1)
- [CVE-2024-39288](https://cve.now/CVE-2024-39288.md): A buffer overflow vulnerability exists in the internet.cgi set\_add\_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39770](https://cve.now/CVE-2024-39770.md): Multiple buffer overflow vulnerabilities exist in the internet.cgi set\_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39769](https://cve.now/CVE-2024-39769.md): Multiple buffer overflow vulnerabilities exist in the internet.cgi set\_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39768](https://cve.now/CVE-2024-39768.md): Multiple buffer overflow vulnerabilities exist in the internet.cgi set\_qos() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39367](https://cve.now/CVE-2024-39367.md): An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39756](https://cve.now/CVE-2024-39756.md): A buffer overflow vulnerability exists in the adm.cgi rep\_as\_router() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-37184](https://cve.now/CVE-2024-37184.md): A buffer overflow vulnerability exists in the adm.cgi rep\_as\_bridge() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39294](https://cve.now/CVE-2024-39294.md): A buffer overflow vulnerability exists in the adm.cgi set\_wzdgw4G() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39358](https://cve.now/CVE-2024-39358.md): A buffer overflow vulnerability exists in the adm.cgi set\_wzap() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-21797](https://cve.now/CVE-2024-21797.md): A command execution vulnerability exists in the adm.cgi set\_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-37357](https://cve.now/CVE-2024-37357.md): A buffer overflow vulnerability exists in the adm.cgi set\_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39774](https://cve.now/CVE-2024-39774.md): A buffer overflow vulnerability exists in the adm.cgi set\_sys\_adm() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39370](https://cve.now/CVE-2024-39370.md): An arbitrary code execution vulnerability exists in the adm.cgi set\_MeshAp() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-37186](https://cve.now/CVE-2024-37186.md): An os command injection vulnerability exists in the adm.cgi set\_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39783](https://cve.now/CVE-2024-39783.md): Multiple OS command injection vulnerabilities exist in the adm.cgi sch\_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39782](https://cve.now/CVE-2024-39782.md): Multiple OS command injection vulnerabilities exist in the adm.cgi sch\_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39781](https://cve.now/CVE-2024-39781.md): Multiple OS command injection vulnerabilities exist in the adm.cgi sch\_reboot() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39754](https://cve.now/CVE-2024-39754.md): A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 10.0)
- [CVE-2024-39773](https://cve.now/CVE-2024-39773.md): An information disclosure vulnerability exists in the testsave.sh functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 5.3)
- [CVE-2024-39608](https://cve.now/CVE-2024-39608.md): A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 10.0)
- [CVE-2024-39273](https://cve.now/CVE-2024-39273.md): A firmware update vulnerability exists in the fw\_check.sh functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.0)
- [CVE-2024-39604](https://cve.now/CVE-2024-39604.md): A command execution vulnerability exists in the update\_filter\_url.sh functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.0)
- [CVE-2024-39357](https://cve.now/CVE-2024-39357.md): A stack-based buffer overflow vulnerability exists in the wireless.cgi SetName() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39359](https://cve.now/CVE-2024-39359.md): A stack-based buffer overflow vulnerability exists in the wireless.cgi DeleteMac() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-36493](https://cve.now/CVE-2024-36493.md): A stack-based buffer overflow vulnerability exists in the wireless.cgi set\_wifi\_basic() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39603](https://cve.now/CVE-2024-39603.md): A stack-based buffer overflow vulnerability exists in the wireless.cgi set\_wifi\_basic\_mesh() functionality of Wavlink AC3000 M33A8.V5030.210 (CVSS 9.1)
- [CVE-2024-39757](https://cve.now/CVE-2024-39757.md): A stack-based buffer overflow vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-34544](https://cve.now/CVE-2024-34544.md): A command injection vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-36272](https://cve.now/CVE-2024-36272.md): A buffer overflow vulnerability exists in the usbip.cgi set\_info() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-36258](https://cve.now/CVE-2024-36258.md): A stack-based buffer overflow vulnerability exists in the touchlist\_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210 (CVSS 10.0)
- [CVE-2024-36295](https://cve.now/CVE-2024-36295.md): A command execution vulnerability exists in the qos.cgi qos\_sta() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39299](https://cve.now/CVE-2024-39299.md): A buffer overflow vulnerability exists in the qos.cgi qos\_sta\_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39803](https://cve.now/CVE-2024-39803.md): Multiple buffer overflow vulnerabilities exist in the qos.cgi qos\_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39802](https://cve.now/CVE-2024-39802.md): Multiple buffer overflow vulnerabilities exist in the qos.cgi qos\_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39801](https://cve.now/CVE-2024-39801.md): Multiple buffer overflow vulnerabilities exist in the qos.cgi qos\_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39800](https://cve.now/CVE-2024-39800.md): Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn\_server\_setup() functionality of Wavlink AC3000 M33A8.V503 (CVSS 9.1)
- [CVE-2024-39799](https://cve.now/CVE-2024-39799.md): Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn\_server\_setup() functionality of Wavlink AC3000 M33A8.V503 (CVSS 9.1)
- [CVE-2024-39798](https://cve.now/CVE-2024-39798.md): Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn\_server\_setup() functionality of Wavlink AC3000 M33A8.V503 (CVSS 9.1)
- [CVE-2024-38666](https://cve.now/CVE-2024-38666.md): An external config control vulnerability exists in the openvpn.cgi openvpn\_client\_setup() functionality of Wavlink AC3000 M33A8.V5030.210505 (CVSS 9.1)
- [CVE-2024-39602](https://cve.now/CVE-2024-39602.md): An external config control vulnerability exists in the nas.cgi set\_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39795](https://cve.now/CVE-2024-39795.md): Multiple external config control vulnerabilities exist in the nas.cgi set\_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39794](https://cve.now/CVE-2024-39794.md): Multiple external config control vulnerabilities exist in the nas.cgi set\_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39793](https://cve.now/CVE-2024-39793.md): Multiple external config control vulnerabilities exist in the nas.cgi set\_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39360](https://cve.now/CVE-2024-39360.md): An os command injection vulnerability exists in the nas.cgi remove\_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39280](https://cve.now/CVE-2024-39280.md): An external config control vulnerability exists in the nas.cgi set\_smb\_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39790](https://cve.now/CVE-2024-39790.md): Multiple external config control vulnerabilities exist in the nas.cgi set\_ftp\_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39789](https://cve.now/CVE-2024-39789.md): Multiple external config control vulnerabilities exist in the nas.cgi set\_ftp\_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39788](https://cve.now/CVE-2024-39788.md): Multiple external config control vulnerabilities exist in the nas.cgi set\_ftp\_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39787](https://cve.now/CVE-2024-39787.md): Multiple directory traversal vulnerabilities exist in the nas.cgi add\_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39786](https://cve.now/CVE-2024-39786.md): Multiple directory traversal vulnerabilities exist in the nas.cgi add\_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39785](https://cve.now/CVE-2024-39785.md): Multiple command execution vulnerabilities exist in the nas.cgi add\_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-39784](https://cve.now/CVE-2024-39784.md): Multiple command execution vulnerabilities exist in the nas.cgi add\_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. (CVSS 9.1)
- [CVE-2024-10429](https://cve.now/CVE-2024-10429.md): WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi set\_ipv6 command injection (CVSS 8.6)
- [CVE-2024-10428](https://cve.now/CVE-2024-10428.md): WAVLINK WN530H4/WN530HG4/WN572HG3 firewall.cgi set\_ipv6 command injection (CVSS 8.6)
- [CVE-2024-10194](https://cve.now/CVE-2024-10194.md): WAVLINK WN530H4/WN530HG4/WN572HG3 Front-End Authentication Page login.cgi Goto\_chidx stack-based overflow (CVSS 8.7)
- [CVE-2024-10193](https://cve.now/CVE-2024-10193.md): WAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi ping\_ddns command injection (CVSS 5.1)
- [CVE-2023-3380](https://cve.now/CVE-2023-3380.md): Wavlink WN579X3 Ping Test adm.cgi injection (CVSS 4.7)
- [CVE-2022-40623](https://cve.now/CVE-2022-40623.md): WAVLINK Quantum D4G (WN531G3) CSRF (no CVSS)
- [CVE-2022-40622](https://cve.now/CVE-2022-40622.md): WAVLINK Quantum D4G (WN531G3) Session Management by IP Address (no CVSS)
- [CVE-2022-40621](https://cve.now/CVE-2022-40621.md): WAVLINK Quantum D4G (WN531G3) Pass-The-Hash (no CVSS)
- [CVE-2022-2488](https://cve.now/CVE-2022-2488.md): WAVLINK WN535K2/WN535K3 touchlist\_sync.cgi os command injection (CVSS 8.0)
- [CVE-2022-2487](https://cve.now/CVE-2022-2487.md): WAVLINK WN535K2/WN535K3 nightled.cgi os command injection (CVSS 8.0)
- [CVE-2022-2486](https://cve.now/CVE-2022-2486.md): WAVLINK WN535K2/WN535K3 os command injection (CVSS 8.0)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wavlink
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.