Wavlink
Page 2 of 3 — Wavlink CVEs from a corpus of 218, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-39762 | Critical | 9.1 | 2025-01-14 | Multiple OS command injection vulnerabilities exist in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craft… |
CVE-2024-39761 | Critical | 10.0 | 2025-01-14 | Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTT… |
CVE-2024-39760 | Critical | 10.0 | 2025-01-14 | Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTT… |
CVE-2024-39759 | Critical | 10.0 | 2025-01-14 | Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTT… |
CVE-2024-39757 | Critical | 9.1 | 2025-01-14 | A stack-based buffer overflow vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP re… |
CVE-2024-39756 | Critical | 9.1 | 2025-01-14 | A buffer overflow vulnerability exists in the adm.cgi rep_as_router() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can… |
CVE-2024-39754 | Critical | 10.0 | 2025-01-14 | A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to ro… |
CVE-2024-39608 | Critical | 10.0 | 2025-01-14 | A firmware update vulnerability exists in the login.cgi functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitr… |
CVE-2024-39604 | Critical | 9.0 | 2025-01-14 | A command execution vulnerability exists in the update_filter_url.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can l… |
CVE-2024-39603 | Critical | 9.1 | 2025-01-14 | A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic_mesh() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially cr… |
CVE-2024-39602 | Critical | 9.1 | 2025-01-14 | An external config control vulnerability exists in the nas.cgi set_nas() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request c… |
CVE-2024-39370 | Critical | 9.1 | 2025-01-14 | An arbitrary code execution vulnerability exists in the adm.cgi set_MeshAp() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP reque… |
CVE-2024-39367 | Critical | 9.1 | 2025-01-14 | An os command injection vulnerability exists in the firewall.cgi iptablesWebsFilterRun() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafte… |
CVE-2024-39363 | Critical | 9.6 | 2025-01-14 | A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craft… |
CVE-2024-39360 | Critical | 9.1 | 2025-01-14 | An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request c… |
CVE-2024-39359 | Critical | 9.1 | 2025-01-14 | A stack-based buffer overflow vulnerability exists in the wireless.cgi DeleteMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP… |
CVE-2024-39358 | Critical | 9.1 | 2025-01-14 | A buffer overflow vulnerability exists in the adm.cgi set_wzap() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead… |
CVE-2024-39357 | Critical | 9.1 | 2025-01-14 | A stack-based buffer overflow vulnerability exists in the wireless.cgi SetName() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP r… |
CVE-2024-39299 | Critical | 9.1 | 2025-01-14 | A buffer overflow vulnerability exists in the qos.cgi qos_sta_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request c… |
CVE-2024-39294 | Critical | 9.1 | 2025-01-14 | A buffer overflow vulnerability exists in the adm.cgi set_wzdgw4G() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can le… |
CVE-2024-39288 | Critical | 9.1 | 2025-01-14 | A buffer overflow vulnerability exists in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP reque… |
CVE-2024-39280 | Critical | 9.1 | 2025-01-14 | An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP reque… |
CVE-2024-39273 | Critical | 9.0 | 2025-01-14 | A firmware update vulnerability exists in the fw_check.sh functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbi… |
CVE-2024-38666 | Critical | 9.1 | 2025-01-14 | An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially craft… |
CVE-2024-37357 | Critical | 9.1 | 2025-01-14 | A buffer overflow vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead… |
CVE-2024-37186 | Critical | 9.1 | 2025-01-14 | An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request… |
CVE-2024-37184 | Critical | 9.1 | 2025-01-14 | A buffer overflow vulnerability exists in the adm.cgi rep_as_bridge() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can… |
CVE-2024-36493 | Critical | 9.1 | 2025-01-14 | A stack-based buffer overflow vulnerability exists in the wireless.cgi set_wifi_basic() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted… |
CVE-2024-36295 | Critical | 9.1 | 2025-01-14 | A command execution vulnerability exists in the qos.cgi qos_sta() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead… |
CVE-2024-36290 | Critical | 10.0 | 2025-01-14 | A buffer overflow vulnerability exists in the login.cgi Goto_chidx() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can l… |
CVE-2024-36272 | Critical | 9.1 | 2025-01-14 | A buffer overflow vulnerability exists in the usbip.cgi set_info() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lea… |
CVE-2024-36258 | Critical | 10.0 | 2025-01-14 | A stack-based buffer overflow vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially cr… |
CVE-2024-34544 | Critical | 9.1 | 2025-01-14 | A command injection vulnerability exists in the wireless.cgi AddMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can… |
CVE-2024-34166 | Critical | 10.0 | 2025-01-14 | An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted… |
CVE-2024-21797 | Critical | 9.1 | 2025-01-14 | A command execution vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can le… |
CVE-2024-54747 | Critical | 9.8 | 2024-12-06 | WAVLINK WN531P3 202383 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-54745 | Critical | 9.8 | 2024-12-06 | WAVLINK WN701AE M01AE_V240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. |
CVE-2024-10429 | High | 7.2 | 2024-10-27 | A vulnerability classified as critical has been found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. Affected is the function set_ipv6 of the file i… |
CVE-2024-10428 | High | 7.2 | 2024-10-27 | A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been rated as critical. This issue affects the function set_ipv6 of… |
CVE-2024-10194 | High | 8.8 | 2024-10-20 | A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been classified as critical. Affected is the function Goto_chidx of… |
CVE-2024-10193 | Medium | 4.7 | 2024-10-20 | A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028 and classified as critical. This issue affects the function ping_ddns of the… |
CVE-2024-38897 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1'live_check.shtml enables attackers to obtain sensitive router information. |
CVE-2024-38896 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1 found a command injection vulnerability through the start_hour parameter of /cgi-bin/nightled.cgi. |
CVE-2024-38895 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1'live_mfg.shtml enables attackers to obtain sensitive router information. |
CVE-2024-38894 | Medium | 5.3 | 2024-06-24 | WAVLINK WN551K1 found a command injection vulnerability through the IP parameter of /cgi-bin/touchlist_sync.cgi. |
CVE-2024-38892 | Medium | 6.5 | 2024-06-24 | An issue in Wavlink WN551K1 allows a remote attacker to obtain sensitive information via the ExportAllSettings.sh component. |
CVE-2023-38861 | Critical | 9.8 | 2023-08-15 | An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via username parameter of the set_sys_adm function in a… |
CVE-2023-32622 | High | 7.2 | 2023-06-30 | Improper neutralization of special elements in WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to execute OS… |
CVE-2023-32621 | High | 7.2 | 2023-06-30 | WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the r… |
CVE-2023-32620 | Medium | 6.5 | 2023-06-30 | Improper authentication vulnerability in WL-WN531AX2 firmware versions prior to 2023526 allows a network-adjacent attacker to obtain a password for the wireles… |
CVE-2023-32613 | High | 8.1 | 2023-06-30 | Exposure of resource to wrong sphere issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow a network-adjacent attacker to use functio… |
CVE-2023-32612 | High | 7.2 | 2023-06-30 | Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which may allow an attacker with an administrat… |
CVE-2023-3380 | Medium | 4.7 | 2023-06-23 | A vulnerability classified as critical has been found in Wavlink WN579X3 up to 20230615. Affected is an unknown function of the file /cgi-bin/adm.cgi of the co… |
CVE-2023-29708 | High | 7.5 | 2023-06-22 | An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factory reset via crafted payload. |
CVE-2022-48166 | High | 7.5 | 2023-02-06 | An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log files and obtain adm… |
CVE-2022-48164 | High | 7.5 | 2023-02-06 | An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configura… |
CVE-2022-48165 | High | 7.5 | 2023-02-03 | An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthenticated attackers to download configura… |
CVE-2022-44356 | High | 7.5 | 2022-11-29 | WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated a… |
CVE-2022-40623 | High | 8.8 | 2022-09-13 | The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 does not utilize anti-CSRF tokens, which, when combined with other issues (such a… |
CVE-2022-40622 | High | 8.8 | 2022-09-13 | The WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 uses IP addresses to hold sessions and does not not use session tokens. Therefore… |
CVE-2022-40621 | High | 7.5 | 2022-09-13 | Because the WAVLINK Quantum D4G (WN531G3) running firmware version M31G3.V5030.200325 and earlier communicates over HTTP and not HTTPS, and because the hashing… |
CVE-2022-37149 | Critical | 9.8 | 2022-08-30 | WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the file adm.cgi. This vulnerability allows… |
CVE-2022-35538 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameters: delete_list, delete_al_mac, b_delete_list and b_delete_al_mac… |
CVE-2022-35537 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameters: mac_5g and Newname, which leads to command injection in page… |
CVE-2022-35536 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: qos_bandwith and qos_dat, which leads to command injection in page… |
CVE-2022-35535 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameter macAddr, which leads to command injection in page /wifi_mesh.sh… |
CVE-2022-35534 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 wireless.cgi has no filtering on parameter hiddenSSID32g and SSID2G2, which leads to command injection in… |
CVE-2022-35533 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 qos.cgi has no filtering on parameters: cli_list and cli_num, which leads to command injection in page /qo… |
CVE-2022-35526 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 login.cgi has no filtering on parameter key, which leads to command injection in page /login.shtml. |
CVE-2022-35525 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameter led_switch, which leads to command injection in page /ledonoff.shtml. |
CVE-2022-35524 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: wlan_signal, web_pskValue, sel_EncrypTyp, sel_Automode, wlan_bssid… |
CVE-2022-35523 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameter del_mac and parameter flag, which leads to command injection in… |
CVE-2022-35522 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: ppp_username, ppp_passwd, rwan_gateway, rwan_mask and rwan_ip, whi… |
CVE-2022-35521 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameters: remoteManagementEnabled, blockPortScanEnabled, pingFrmWANFilt… |
CVE-2022-35520 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 api.cgi has no filtering on parameter ufconf, and this is a hidden parameter which doesn't appear in POST… |
CVE-2022-35519 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 firewall.cgi has no filtering on parameter add_mac, which leads to command injection in page /cli_black_li… |
CVE-2022-35518 | Critical | 9.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 nas.cgi has no filtering on parameters: User1Passwd and User1, which leads to command injection in page /n… |
CVE-2022-35517 | High | 8.8 | 2022-08-10 | WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 adm.cgi has no filtering on parameters: web_pskValue, wl_Method, wlan_ssid, EncrypType, rwan_ip, rwan_mask… |
CVE-2022-34577 | Critical | 9.8 | 2022-07-25 | A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2022-34576 | High | 7.5 | 2022-07-25 | A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2022-34575 | Medium | 5.7 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing fct… |
CVE-2022-34574 | Medium | 5.7 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing Tft… |
CVE-2022-34573 | Medium | 6.3 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to arbitrarily configure device settings via accessing the pa… |
CVE-2022-34572 | Medium | 5.7 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet password via accessing the page tftp.txt. |
CVE-2022-34571 | High | 8.0 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system key information and execute arbitrary co… |
CVE-2022-34570 | High | 7.5 | 2022-07-25 | WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the mess… |
CVE-2022-34049 | Medium | 5.3 | 2022-07-20 | An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows unauthenticated attackers to download log files and configuration data. |
CVE-2022-34048 | Medium | 6.1 | 2022-07-20 | Wavlink WN533A8 M33A8.V5030.190716 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the login_page parameter. |
CVE-2022-34047 | High | 7.5 | 2022-07-20 | An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety… |
CVE-2022-34046 | High | 7.5 | 2022-07-20 | An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtm… |
CVE-2022-34045 | Critical | 9.8 | 2022-07-20 | Wavlink WN530HG4 M30HG4.V5030.191116 was discovered to contain a hardcoded encryption/decryption key for its configuration files at /etc_ro/lighttpd/www/cgi-bi… |
CVE-2022-2488 | High | 8.0 | 2022-07-20 | A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_… |
CVE-2022-2487 | High | 8.0 | 2022-07-20 | A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled… |
CVE-2022-2486 | High | 8.0 | 2022-07-20 | A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=up… |
CVE-2022-34592 | Critical | 9.8 | 2022-07-07 | Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers… |
CVE-2022-31847 | High | 7.5 | 2022-06-14 | A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensitive router information via a crafted P… |
CVE-2022-31846 | High | 7.5 | 2022-06-14 | A vulnerability in live_mfg.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd… |
CVE-2022-31845 | High | 7.5 | 2022-06-14 | A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec c… |
CVE-2022-31311 | Critical | 9.8 | 2022-06-14 | An issue in adm.cgi of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to execute arbitrary commands via a crafted POST request. |
CVE-2022-31309 | High | 7.5 | 2022-06-14 | A vulnerability in live_check.shtml of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to obtain sensitive router information via execution of the e… |