Seven OS command injection vulnerabilities in WAVLINK routers, mesh units and access points were published on 1 and 2 November 2026. All of them came through VulDB, each links to a proof-of-concept write-up on GitHub (six of the seven by a researcher using the name pipiyyb), and each record says the exploit is public. The records say WAVLINK was contacted early about the disclosure. None of them mentions a firmware fix.

Affected models

The CVE records name a specific model and firmware build for each flaw:

  • CVE-2026-120195: WL-WN579A3-A, build 2026-03-10-94f93d4. The wlan_ssid field in the initial setup wizard (set_wzdgwMesh in /cgi-bin/adm.cgi).
  • CVE-2026-120196: WN579X3-D V250402. The Name field of the port forwarding function in /cgi-bin/wapi.cgi.
  • CVE-2026-120197: WL-WN530HG4B M_V260724. The same port forwarding Name field.
  • CVE-2026-120198: WL-WN530BE1-A V251117. The group_name and IP-FROM arguments in /protocol.csp.
  • CVE-2026-120227: WN701AE M01AE_V260105. The rule_name argument when deleting a static route.
  • CVE-2026-120228: WN553X1-B V260403_2.0.0. The group_id and group_name arguments in the ioos service.
  • CVE-2026-120280: WN536AX6-A V260507. The same arguments in the WireGuard client group handler in /protocol.csp.

In every case, text sent through the web interface ends up in a system command, so an attacker who can reach that interface can run their own commands on the device. VulDB, which assigned the CVEs, rates three of them (CVE-2026-120195, CVE-2026-120198 and CVE-2026-120280) at 10.0 in CVSS 3.1, with a vector that needs no login. The other four score 9.9, which in VulDB's vector means the attacker needs a low-privilege account. That is small comfort on devices where the admin password was never changed.

Why it matters for a smart home

A router or mesh point is the device every Wi-Fi plug, camera and sensor talks through. Someone running commands on it can watch or redirect that traffic, reach devices that were meant to stay on the local network, or keep a foothold in the home. The setup wizard flaw stands out because new or reset units sit in that wizard before anyone sets a password.

What owners can do

With no patch listed, the options are limited:

  • Check the WAVLINK support pages for newer firmware for your model and install it if one appears.
  • Turn off remote management, so the admin panel is not reachable from the internet.
  • Change the default admin password and do not share the account.
  • Finish the setup wizard right away on a new or reset device, ideally with the WAN cable unplugged.
  • If your model stays without a fix, consider moving it to a network segment without sensitive devices, or replacing it.