Wavlink Wl-WN535K3 Firmware vulnerabilities

5 CVEs affecting Wavlink Wl-WN535K3 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-50757, published 2025-09-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-2487, published 2022-07-20. Critical severity, CVSS 9.8. EPSS: 79.3% chance of exploitation in the next 30 days. A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. This vulnerability affects unknown code of the file /cgi-bin/nightled.cgi. The manipulation of the argument…
CVE-2022-2488, published 2022-07-20. Critical severity, CVSS 9.8. EPSS: 33.4% chance of exploitation in the next 30 days. A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/touchlist_sync.cgi. The manipulation of the…
CVE-2022-2486, published 2022-07-20. Critical severity, CVSS 9.8. EPSS: 30.2% chance of exploitation in the next 30 days. A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. This affects an unknown part of the file /cgi-bin/mesh.cgi?page=upgrade. The manipulation of the argument…
CVE-2025-50757, published 2025-09-02. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_adm function via the username parameter. This vulnerability allows attackers to execute arbitrary…
CVE-2025-50755, published 2025-09-02. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. Wavlink WN535K3 20191010 was found to contain a command injection vulnerability in the set_sys_cmd function via the command parameter. This vulnerability allows attackers to execute arbitrary…