Five CVSS 10 flaws expose WAVLINK routers through DNS, OpenVPN, and WireGuard

November 2, 2026. The NVD publishes five vulnerabilities in quick succession against WAVLINK routers, all scored CVSS 10.0 — the maximum. November 2, 2026, again. Every entry carries the line “the exploit has been made public” and “the vendor was contacted early”. November 2, 2026, still. No patch is announced. The headline fits in one line: on these boxes, the DNS, OpenVPN, and WireGuard paths — the very ones that cross the perimeter — accept input that an attacker can turn into system commands.

This is not a bundle of firmware trivia. It is a reminder that the edge router, the device everyone plugs in and forgets, remains the quietest attack surface on a network.

What the five CVEs describe

The five entries form a coherent set, concentrated on two product families and three sensitive network functions.

• CVE-2026-120345 hits the WN551X3-A on firmware M51X3_V251020-WO-182e965. In the /bin/ioos binary, the sub_41a430 function of the DNS resolution handler injects the data argument into a shell command. The attack is launched remotely, with no authentication.
• CVE-2026-120280 targets the WN536AX6-A on firmware V260507. The wireguard_cli_group handler in /protocol.csp concatenates the group_id and group_name fields into a command — command injection inside the WireGuard management path.
• CVE-2026-120281 affects the same WN536AX6-A. The strcpy function in /protocol.csp, inside the OpenVPN handler, copies the openvpn_ip argument without bounds — a stack-based buffer overflow, reachable remotely.
• CVE-2026-120276 and CVE-2026-120277 round out the batch on the V260507_2.0.0 revision of the WN536AX6-A.

The common thread is disturbing. The three most detailed flaws sit not in some peripheral feature but in the components that do a router’s actual job: resolving names, establishing a VPN tunnel, carrying traffic. An attacker who controls those paths does not just own the box — they settle into the transit point for every byte on the local network.

Why a CVSS 10 on a consumer router changes the calculus

A CVSS 10.0 means a network-vector vulnerability with no privileges and no user interaction, and a complete impact on confidentiality, integrity, and availability. On an enterprise server, that score triggers an incident process. On a WAVLINK — a brand of budget boxes sold in volume retail — it often goes unnoticed, because nobody maintains these devices.

The exposure of the DNS and VPN functions makes it worse in a specific way. DNS is the entry point through which a router directs every name resolution: compromising it lets an attacker redirect traffic, poison the local cache, or exfiltrate queries. OpenVPN and WireGuard are the services users deliberately expose to the internet to reach their network remotely: an injection flaw in their management turns the legitimate access channel into a front door. In all three cases the attacker does not need to sneak in — the door is held open by the device’s own function.

Add the public exploit. “The exploit has been made public” is not rhetorical filler: it means a proof of concept, or a ready-made module, is circulating. On this class of device, the gap between a published proof of concept and automated mass exploitation is measured in days.

Who is actually exposed

The blast radius extends well beyond the person who bought a discounted box. WAVLINK devices land in three configurations where the risk peaks:

• Small offices and shops, which drop a cheap Wi-Fi router behind the ISP gateway and never touch it again. The firmware stays at its original build, often for years.
• Exposed home VPNs, where a user configures OpenVPN or WireGuard on the router to reach their network from outside. That is precisely the function the flaws attack.
• Installers and resellers, who deploy these boxes for customers with no patch follow-up and leave them reachable from the internet.

In every case the firmware is not watched, and the router stays reachable. The combination of “CVSS 10 + public exploit + no patch” becomes a script-level compromise.

What to do now

There is no official fix at the time of publication. The response is therefore isolation first, then monitoring.

• Inventory these models. Find every WN551X3-A and WN536AX6-A on the estate. A router forgotten in a closet is the first link in a compromise.
• Remove internet exposure. Disable remote access to the admin panel, and if an OpenVPN or WireGuard server runs on the box, shut it down or move it to a separate host that receives patches.
• Isolate the router. Put it behind a border you control and segment the devices that connect to it — cameras, printers, IoT — away from the rest of the network.
• Watch DNS. Queries toward unusual domains or anomalous redirects are the first symptom of a compromised DNS handler.
• Plan the replacement. With no patch announced, the useful life of these boxes is effectively over. Replace them with hardware whose vendor publishes regular updates.

None of these measures fix the flaw. They shrink the surface during a window — potentially a long one — in which no patch exists.

Verdict

The problem is not that a router contains a command injection; it is that a whole batch of maximum-severity flaws hits the border functions, with public exploits, on hardware nobody maintains. If you run a WAVLINK WN551X3-A or WN536AX6-A, treat it as compromised by default: cut its internet exposure and replace it. If you deploy this kind of box for customers, stop doing so without a verifiable update channel. The lesson outlives the brand: an unpatched edge router is not a vulnerable device, it is an already-lost one — the only question is when the DNS it resolves stops pointing where you think it does.

References

• NVD — CVE-2026-120345 (WAVLINK WN551X3-A, DNS Resolution Handler)
• NVD — CVE-2026-120280 (WAVLINK WN536AX6-A, WireGuard command injection)
• NVD — CVE-2026-120281 (WAVLINK WN536AX6-A, OpenVPN stack overflow)
• InfoSecNexus — Live Cybersecurity Brief, November 3, 2026