AI analysis
Claude Opus · 7 Nov 2026, 10:21 CET
WAVLINK WN551X3-A firmware flaw lets remote attackers run system commands
WAVLINK WN551X3-A devices on firmware M51X3_V251020-WO-182e965 contain a remotely reachable OS command injection rated CVSS 3.1 10.0. Public exploit details exist and no fix is listed, so restrict network access to affected devices now.
In plain terms
The WAVLINK WN551X3-A is a network device, described in one reference as a router. Its firmware version M51X3_V251020-WO-182e965 has a flaw in the part of the software that handles DNS resolution, the process of turning names into network addresses. Because the device does not properly check certain input, an attacker can slip in operating system commands, which is known as command injection. The device then runs those commands as if they were its own instructions.
According to the record, the attack can be started over the network, does not require a password and does not need anyone to click anything. Anyone running this device at home, in a small office or at a branch site should treat it as at risk until a fix or vendor guidance is available.