AI analysis
Claude Opus · 7 Nov 2026, 10:21 CET
WAVLINK WN551X3-A firmware flaw allows remote OS command injection
WAVLINK WN551X3-A firmware M51X3_V251020-WO-182e965 has a remotely reachable OS command injection rated CVSS 3.1 10.0. Public exploit details exist and no fix is listed, so restrict management access and isolate affected devices.
In plain terms
A security flaw has been reported in WAVLINK WN551X3-A network devices running firmware version M51X3_V251020-WO-182e965. One public research reference describes the device as a router. The flaw is in the part of the firmware that handles WireGuard group settings. WireGuard is a VPN technology. When the device receives a group name, it passes that value to the operating system without checking it properly. This is called command injection. It means an attacker can make the device run commands of their choosing.
The flaw can be triggered over the network. If it is exploited, an attacker could take full control of the device and the traffic that passes through it. Home users, small offices and anyone else running this WAVLINK model with the listed firmware should care, particularly if the device's management interface can be reached from the internet or from untrusted networks.