CVE-2026-91072

A vulnerability was found in the WAVLINK WN551X3-A device, affecting the sub_41a430 function in /bin/ioos within the DNS Resolution Handler component. Manipulating the data argument results in OS command injection, and the attack can be launched remotely. The exploit has been made public and could be used.

The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. APIs exposed through the WSO2 API Manager's API Gateway are not affected.

A vulnerability was found in the WAVLINK WN551X3-A device in the system function of /bin/ioos, within the WireGuard CLI Group Handler component. Manipulating the group_name argument leads to OS command injection, and the attack can be performed remotely. The exploit has been publicly disclosed and may be used.

A vulnerability was identified in Termix-SSH Termix up to 2.9.2 affecting the /plugin-api/file-manager/transferToHost endpoint. Manipulation of the destPath argument leads to path traversal, and the attack can be launched remotely. The exploit is publicly available and may be used.

A vulnerability was identified in Linksys E8450 version 1.2.00.360516 in the strcpy function of /www/cgi-bin/portal.cgi. Manipulation of the hidden_timezone argument leads to a stack-based buffer overflow. The attack can be executed remotely, and the vendor did not respond to the disclosure.

A vulnerability was determined in WAVLINK WN536AX6-A version V260507 in the host_black function of /protocol.csp. Manipulation of the mac argument causes OS command injection. The exploit has been publicly disclosed and remote exploitation is possible.

A vulnerability was found in WAVLINK WN536AX6-A version V260507 in the OpenVPN Handler component, in the strcpy function of /protocol.csp. Manipulation of the openvpn_ip argument results in a stack-based buffer overflow. The exploit has been made public and the attack may be launched remotely.

A vulnerability has been found in WAVLINK WN536AX6-A version V260507 in the WireGuard component, in the wireguard_cli_group handler of /protocol.csp. Manipulation of the group_id/group_name arguments leads to OS command injection. The exploit has been disclosed publicly and the attack may be initiated remotely.

A flaw has been found in WAVLINK WN536AX6-A version V260507 in the openvpn_cli Handler component, in an unknown function of /protocol.csp. Manipulation of the file_id argument can lead to OS command injection. The exploit has been published and the attack can be launched remotely.

A vulnerability was detected in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_41a1d8 function of the /bin/ioos file, related to the WireGuard CLI group handler. Manipulation of the group_name argument leads to OS command injection. The issue can be exploited remotely and a public exploit is already available.