On November 1 and 2, 2026, NVD received 22 critical CVEs affecting routers and access points. 18 target WAVLINK across seven models, twelve of them on just two devices: the WN536AX6-A and the WN553X1-B. The rest cover the Linksys E8450, the D-Link DIR-505 and two new flaws in the Oray Pugongying X5 Pro.
All were filed by VulDB as CNA and sit in NVD status Received: no NIST analysis, no CPE configuration, no fixed version. For 21 of them, the description says the exploit has been made public. None is in the CISA KEV catalog at the time of writing.
What stands out in the WAVLINK batch is how concentrated it is: most of the flaws go through the admin interface's VPN features (the OpenVPN and WireGuard handlers).
WAVLINK WN536AX6-A: six CVEs
Firmware named: V260507 (V260507_2.0.0 for two entries).
| CVE | Entry point | Parameter | Weakness | Authentication | CVSS 3.1 (VulDB) |
|---|---|---|---|---|---|
| CVE-2026-120281 | /protocol.csp, OpenVPN handler | openvpn_ip | Stack overflow (CWE-121) | none | 10.0 |
| CVE-2026-120280 | /protocol.csp, wireguard_cli_group | group_id / group_name | Command injection (CWE-78) | none | 10.0 |
| CVE-2026-120279 | /protocol.csp, openvpn_cli handler | file_id | Command injection (CWE-78) | none | 10.0 |
| CVE-2026-120277 | /bin/ioos, WireGuard CLI group | group_name | Command injection (CWE-78) | none | 10.0 |
| CVE-2026-120276 | /bin/ioos, web interface | group_name | Command injection (CWE-78) | none | 10.0 |
| CVE-2026-120282 | /protocol.csp, host_black | mac | Command injection (CWE-78) | required | 9.9 |
Five of the six are scored as unauthenticated (PR:N). Several entries describe very similar paths (the WireGuard group's group_name parameter appears three times, seen once from /protocol.csp and twice from the /bin/ioos binary), so some may overlap. That is a guess on my part; NVD lists them as separate flaws.
WAVLINK WN553X1-B: six CVEs
Firmware named: V260403_2.0.0. All in the /bin/ioos binary.
| CVE | Component | Parameter | Authentication | CVSS 3.1 (VulDB) |
|---|---|---|---|---|
| CVE-2026-120240 | WireGuard CLI group | group_id / group_name | required | 9.9 |
| CVE-2026-120239 | WireGuard CLI | file_id | required | 9.9 |
| CVE-2026-120238 | ovpn_file handler | file_id | required | 9.9 |
| CVE-2026-120231 | OpenVPN CLI | file_id | required | 9.9 |
| CVE-2026-120228 | ioos service | group_id / group_name | required | 9.9 |
| CVE-2026-120229 | function sub_416B50 | file_id | high privileges | 9.1 |
All are OS command injections (CWE-78), and all require a session on the interface: PR:L for five, PR:H for the sixth.
Other WAVLINK models: six CVEs
| CVE | Model | Firmware named | Entry point | Parameter | Authentication | CVSS 3.1 (VulDB) |
|---|---|---|---|---|---|---|
| CVE-2026-120195 | WL-WN579A3-A | 2026-03-10-94f93d4 | /cgi-bin/adm.cgi, set_wzdgwMesh (setup wizard) | wlan_ssid | none | 10.0 |
| CVE-2026-120198 | WL-WN530BE1-A | V251117 | /protocol.csp, con_check_read_finish | group_name / IP-FROM | none | 10.0 |
| CVE-2026-120230 | WN701AE | 260105 | ioos web backend, del_vlan_group | vlan_name | required | 9.9 |
| CVE-2026-120227 | WN701AE | M01AE_V260105 | static_route_setting.sh, del_staticrule | rule_name | required | 9.9 |
| CVE-2026-120197 | WL-WN530HG4B | M_V260724 | /cgi-bin/wapi.cgi, port_forward | Name | required | 9.9 |
| CVE-2026-120196 | WN579X3-D | V250402 | /cgi-bin/wapi.cgi, port_forward | Name | required | 9.9 |
The WL-WN579A3-A case is worth a note: the injection goes through the Wi-Fi network name typed into the initial setup wizard, with no authentication according to the vector.
This is not the WL-WN530BE1-A's first command injection either: it already featured in our October 13 roundup of Netcore and Wavlink routers.
Linksys E8450: CVE-2026-120283
Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0)
A stack overflow in /www/cgi-bin/portal.cgi: a strcpy call copies the hidden_timezone parameter with no length check. Firmware named: 1.2.00.360516. The description notes that Linksys was contacted ahead of disclosure and did not respond. It is the only entry in the batch that does not mention a public exploit.
D-Link DIR-505: CVE-2026-120189
Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0)
The bug is not in the web interface but in the travel router's TFTP server (/usr/bin/tftpd): the filename sent during an upload (functions save_upload_file and mp_upload_file) triggers a stack overflow. Firmware named: 1.10B02. A proof of concept is on GitHub.
Oray Pugongying X5 Pro: CVE-2026-120224 and CVE-2026-120225
Two more flaws in firmware up to 7.6.1, following the three CRLF injections in late October. Oray did not respond to VulDB.
- CVE-2026-120224 (9.9, authentication required): improper authorization in
run_apis_by_json/run_async_task. Going by the title of the referenced report, a restricted account can trigger a factory reset through the JSON batch API. - CVE-2026-120225 (9.1, high privileges): path traversal in
config_restore_exthrough thefilenameparameter of the configuration restore feature. The referenced report's title describes it as leading to root code execution.
What these flaws mean
On these firmwares, web and CGI services usually run with full privileges, so a command injection in practice gives complete control of the device. That is what the S:C in every VulDB vector reflects.
For entries scored PR:L, the attacker needs a session on the interface. On a consumer router that often comes down to the admin password, sometimes still the factory default. For PR:N entries, reaching the interface is enough.
Public exploits, no fix in NVD, vendors that are silent or slow to respond: these models are natural targets for botnets that recruit routers. That is an inference; no exploitation is documented in these entries.
Affected versions
NVD provides no CPE configuration and no fixed version for any of these 22 CVEs. Each description names a single firmware build (Oray: up to 7.6.1). That does not make other versions safe; they simply were not tested.
Check each model's support page at WAVLINK, Linksys, D-Link and Oray. A device past end of life will probably never get a fix.
Detection
- Inventory: look for these models on your network, including branch offices, remote workers' homes and meeting rooms.
- Exposure: make sure no admin interface is reachable from the Internet, and that no TFTP service is open on the DIR-505.
- Logs, where they exist: requests to
/protocol.csp,/cgi-bin/wapi.cgi,/cgi-bin/adm.cgi(WAVLINK) or/www/cgi-bin/portal.cgi(Linksys) carrying shell metacharacters or unusually long values. - Behavior: unusual outbound traffic from the device, changed VPN or DNS settings, unexplained reboots.
Mitigation
- Turn off remote administration on all these devices.
- Disable the VPN features (OpenVPN, WireGuard) on WAVLINK models if you do not use them.
- Change factory passwords: more than half the flaws in this batch need a session.
- Isolate devices that cannot be updated in a segment with no path to workstations or servers.
- Retire models with no fixed firmware. A consumer router has no place on a business network.
Why continuous monitoring of your network gear matters
None of these 22 CVEs is tied to a CPE, so monitoring that relies only on CPE matching will not see them. You also have to search by product name.
With cveo.tech, list your routers and access points by exact model and get an alert as soon as a CVE names them, even when NVD has not analyzed it.