The Night WAVLINK Routers Became a Hacker's Playground

It started with one line in a vulnerability feed.

Then another line appeared. Then six more.

On November 1 2026 eight critical command injection flaws tied to WAVLINK networking gear went public within hours of each other. Every one scored 9.1 or higher on the CVSS scale. One scored a perfect 10.

The small box blinking under your desk could be one of them.

The Number Nobody Wants to See

The public tracker OpenCVE now lists 233 vulnerabilities linked to WAVLINK products.

Read that again. Two hundred and thirty three.

How many WAVLINK routers sit exposed on the internet tonight? No researcher has published a verified count. That silence may be the most unsettling part of the story. You cannot defend what nobody has counted.

A Researcher Opens the Box

The trail begins with a researcher who goes by the name shuyi.

The target was the WAVLINK WN553X1-B running firmware V260403_2.0.0. Inside sat OpenWrt 21.02 on a MediaTek MT7981 chip. The researcher pulled the firmware apart and brought it back to life inside an emulator.

Deep in the system was a program called ioos. It runs as root, which means it has total control of the device.

One part of ioos handles OpenVPN settings. It accepts a value called file_id. According to the researcher that value travels straight into a system shell without proper cleaning. A logged in attacker can slip extra commands inside it. The router then runs those commands as root.

The proof was a single line returned by the emulated device. It said the attacker was now user zero. Root.

That flaw became CVE-2026-120231.

Eight Doors Opened in One Day

CVE-2026-120231 did not arrive alone. Here is the full lineup from November 1 2026.

• CVE-2026-120231 hits the WN553X1-B. The OpenVPN handler in /bin/ioos mishandles file_id. Score 9.9 Critical.
• CVE-2026-120229 hits the same WN553X1-B. Another function in /bin/ioos mishandles file_id. Score 9.1 Critical. This one needs high level account access.
• CVE-2026-120228 hits the WN553X1-B again. The ioos service mishandles group_id and group_name. Score 9.9 Critical.
• CVE-2026-120230 hits the WN701AE on firmware 260105. The VLAN group delete function mishandles vlan_name. Score 9.9 Critical.
• CVE-2026-120227 hits the WN701AE on firmware M01AE_V260105. The static route delete script mishandles rule_name. Score 9.9 Critical.
• CVE-2026-120197 hits the WL-WN530HG4B on firmware M_V260724. The port forwarding function in wapi.cgi mishandles the Name field. Score 9.9 Critical.
• CVE-2026-120196 hits the WN579X3-D on firmware V250402. The same port forwarding weakness appears in wapi.cgi. Score 9.9 Critical.
• CVE-2026-120195 hits the WL-WN579A3-A on firmware 2026-03-10-94f93d4. The setup wizard mishandles wlan_ssid. Score 10 Critical.

Five different router models. Four different code paths. One shared failure. User input reached the shell.

Every record carries the same quiet sentence. The exploit has been disclosed to the public.

And the WN553X1-B story keeps growing. More entries from the same batch describe similar injection flaws in its WireGuard handler and its ovpn_file handler.

The One That Needs No Password

Most of these flaws require a login. CVE-2026-120195 is different.

It lives in the setup wizard of the WL-WN579A3-A. That is the screen you see the moment you unbox the router. You also see it again after a factory reset.

The researcher found a filter meant to block dangerous characters. It checked only two of them. Everything else slipped through.

During that setup window an attacker needs no password at all. No cookie either. Just a request and a router that has not been configured yet.

Think about when that window opens. It opens when the device is brand new and the owner is busy reading the manual. It opens again after a reset meant to fix a problem.

The most trusting moment in a router's life is also its most exposed.

Déjà Vu in the Code

Security researchers have a saying. Bugs travel in families.

In October 2026 a different WAVLINK model called the WL-WN530BE1-A was hit by CVE-2026-113802. The flaw sat in a binary named ioos. The vulnerable value was named file_id. The handler dealt with OpenVPN files.

Sound familiar?

That earlier flaw was worse. A forged header made the router believe the request came from itself. The login page was skipped. Commands ran as root with no password at all. Its EPSS score estimated a 3.47 percent chance of exploitation within 30 days.

The pattern goes back further. In early 2025 Cisco Talos reported 44 vulnerabilities and 63 CVEs in the WAVLINK AC3000 router. Talos said WAVLINK declined to release a patch.

There is one hopeful thread. For CVE-2026-110957 WAVLINK confirmed the finding and shipped new firmware. The vendor said the vulnerable code no longer builds a shell command. It now passes arguments safely through execvp.

So the fix is known. The question is how fast it reaches every model.

Why "Low Privileges" Brings Little Comfort

Most of these CVEs list privileges required as low. That means the attacker needs some kind of login first.

Here is the catch. WAVLINK's own help page says the default router password is admin if nobody changed it.

How many owners never changed it? Nobody knows that number either.

The records also mark the scope as changed. In plain terms the damage can spread beyond the vulnerable component itself. A router sees every device on your network. It sees your laptop and your phone and your cameras. It sees every connection leaving your home or office.

An attacker with root on the router is not just inside the box. That attacker sits at the front door of everything behind it.

Illustration only. Photo "19 inch rackmount Ethernet switches and patch panels" by Dsimic via Wikimedia Commons under Creative Commons Attribution ShareAlike 4.0.

What the Records Do Not Say

A good thriller needs honesty about what is still unknown.

• None of these eight CVEs appears in the CISA Known Exploited Vulnerabilities catalog.
• No confirmed attacks in the wild have been publicly reported for them.
• The CVE records list no patch and no official workaround.
• Most of the records have no EPSS score yet.
• Every record says WAVLINK was contacted early about the disclosure.

None of that means you are safe. It means the clock is running and nobody has posted the time.

Public exploit details plus no listed patch is a dangerous combination. Attackers read the same feeds defenders do.

Lock It Down Tonight

You do not need to panic. You do need to act.

1. Find your model and firmware. Check the label on the router and the status page in its admin panel.
2. Change the admin password now. Never keep admin as the password. Use something long and unique.
3. Turn off remote management. The admin page should never be reachable from the internet.
4. Finish setup on a private connection. For new or reset devices complete the setup wizard quickly and only on a wired connection you control.
5. Disable features you do not use. If you never use the built in VPN or port forwarding then switch them off.
6. Get firmware only from wavlink.com. WAVLINK warned in October 2026 that scam websites are impersonating the company. Firmware updates from WAVLINK are free.
7. Separate your network. Put cameras and smart devices on a guest network away from your main computers.
8. Plan a replacement. If no fixed firmware appears for your model then budget for a router with a strong update record.

The Last Light on the Router

Tonight the little lights on millions of routers will blink the same way they always do. Nothing will look different.

That is exactly how router compromises work. No alarm. No pop up. No warning.

Eight new doors opened on November 1 2026. Whether yours stays shut depends on what you do before the next line appears in the feed.