Routers: 11 Critical CVEs in September — D-Link, Totolink, Netis, WAVLINK

Eleven vulnerabilities rated CVSS 9.1 to 9.9 were published between September 8 and 14, 2026 across routers and access points from four vendors. Most have a public exploit.

This is the second batch of its kind in three weeks — we covered six similar CVEs in late August. That repetition is itself the information: this isn't a wave, it's the steady state for this hardware category.

But this batch brings something the previous one didn't: a technical thread running between two competing vendors.

The Eleven CVEs

The Common Thread: a Web Server Discontinued in 2005

Look at the vulnerable paths:

• Totolink A3002MU — all four CVEs target the component named boa
• D-Link DWR-M921 — both CVEs target /boafrm/formDiskFormat and /boafrm/formDiskCreateShare

Two competing vendors, two different product lines, the same embedded web server: Boa.

Boa is a minimalist HTTP server designed for embedded use. Its development stopped in 2005. It has received no security fix in twenty-one years, and never will.

Yet it keeps shipping in firmware sold in 2026, because it's carried over as-is in development kits supplied by chipset manufacturers, then integrated by device vendors without anyone asking where the code came from.

This isn't an isolated case — Boa has already been identified as a recurring component in compromised IoT supply chains. Every new boafrm CVE is a reminder that the problem is structural: it isn't fixed CVE by CVE, it's fixed by changing the component, which none of these vendors will do on hardware already sold.

The boafrm prefix in an admin URL is therefore a useful signal: it says the device rests on a base abandoned two decades ago.

The Three That Stand Out

Seven of the eleven are classic stack overflows in form handlers. Three deserve particular attention.

CVE-2026-61516 — Netis NX10: just ask for the admin password

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the exposed credential against the login handler to establish a fully authenticated administrator session.

No memory corruption, no exploit to tailor to an architecture. The attacker politely asks for the administrator password, and the device hands it over.

It's the most reliable of the eleven. A stack overflow can fail, crash the device, need tuning per exact version. An information disclosure works first time, quietly, and leaves the attacker with a perfectly legitimate administrator session — indistinguishable from a normal login in the logs.

CVE-2026-89009 — WAVLINK: it isn't even the web interface

WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the sync_server daemon on TCP port 13136. The daemon, which runs as root and requires no authentication, accepts a 100-byte filename field in its protocol header without path canonicalization, allowing attackers to supply an absolute path and write arbitrary content to overwrite startup scripts or credential stores to achieve persistent system compromise.

Three compounding elements:

1. The vulnerable service isn't the web interface but a proprietary daemon on TCP port 13136. An administrator who had restricted access to the admin interface would not be protected.
2. It runs as root and requires no authentication. This isn't a missed check, there is no check at all.
3. It accepts an absolute path without canonicalization — so arbitrary write anywhere on the filesystem.

The description names the objective itself: overwrite startup scripts or credential stores, for persistent system compromise.

It's also the only one in the batch with a clearly identified fixed version: M35M1_V250922.

CVE-2026-90702 and 90703 — D-Link DWR-M921: command injection

The only two OS command injections in the batch, in the disk format and share creation functions. The PR:H indicates high privileges required — but on these devices that simply means "be logged into the admin interface", which default credentials often make trivial.

Command injection is more direct than an overflow: no architecture constraints, no memory protection to defeat. It just works.

The D-Link DIR-823G Case

CVE-2026-90680 targets firmware 1.0.2B05_20181207. Read the date encoded in the name: December 7, 2018.

A 2018 firmware is still the subject of security research in 2026, because devices are still running it. The DIR-823G is an entry-level, widely distributed model, and very probably out of vendor support.

That's the point to take away about this category: hardware service life far exceeds software support life. A router bought eight years ago works perfectly and never announces that it stopped receiving fixes.

For CVE-2026-90680, the targeted function is strcpy in /HNAP1/SetStaticRouteSettings — HNAP being D-Link's management protocol, itself historically troublesome.

Versions

NVD exposes a fixed version only for WAVLINK. For the others you need each model's support page — and for the DIR-823G, consider that the fix may not exist.

Audit to Run

1. What answers from outside

The highest-value check, applicable to your whole network estate:

# From an EXTERNAL connection
nmap -Pn -p 80,443,8080,8443,13136 <public-ip>

Port 13136 deserves a special mention: that's the WAVLINK daemon. If it answers, the device is exploitable without authentication.

2. Inventory models and firmware

The question you need to answer in minutes: which models are deployed, at which version, and where? If answering takes a day, that's the real problem.

3. Signs of compromise

• Modified DNS servers — the most frequent and most revealing signal
• Undocumented port forwards
• Unknown administrator accounts
• Modified startup scripts — specifically for WAVLINK, that's the attack's stated objective
• Outbound traffic initiated by the device to destinations unrelated to its function

Mitigation

1. Turn off remote administration

Immediate, free, and effective against nearly all of these CVEs:

Admin interface → Management → disable "Remote access"

Important exception: this does not protect against CVE-2026-89009 (WAVLINK), since the vulnerable service isn't the web interface. For that one you need to filter port 13136 at the network level, or update.

2. Change default credentials

Nine of the eleven CVEs have a privilege prerequisite (PR:L or PR:H). On these devices that prerequisite evaporates wherever factory credentials remain — which is extremely common.

3. Update where a fix exists

WAVLINK to M35M1_V250922. For the others, check the model's support page.

4. For devices with no fix

The 2018 D-Link DIR-823G and, more generally, any out-of-support model: there is no third option.

• Replace with a model whose vendor maintains firmware
• Or isolate strictly: no internet exposure, administration reachable from a single management IP, and treat the network behind it as potentially exposed

5. Segment

Verify your guest network is genuinely isolated from the admin interface of the device serving it. It's an extremely common misconfiguration, and it turns a visitor into a potential attacker.

Why Continuous Monitoring of Network Gear Matters

This second batch in three weeks says it all: routers and access points produce a continuous stream of critical CVEs with public exploits, carried by components abandoned twenty years ago that nobody inventories. These devices appear in no software inventory, show up in no OS scan, and keep working perfectly once compromised — nothing signals the problem.

With cveo.tech, inventory your routers, access points and network devices alongside your servers, and get automatic alerts whenever a critical CVE targets one of your exact versions. So a public exploit landing on a model in your estate is a notification, not a discovery.