Your Router Is the Open Door: WAVLINK Zero-Days and Ivanti Exploits Hitting SMBs Right Now
Twenty-one critical vulnerabilities published in a single 24-hour window. All of them remotely exploitable. Most of them carrying a maximum CVSS score of 10.0. And the majority targeting a brand of router that turns up regularly in small business offices and back rooms across the UK.
This is not a slow news day dressed up as a crisis. The data is clear, the exploits are public, and the attack surface is sitting on a shelf next to someone’s kettle.
The WAVLINK Problem: Twenty-Plus Flaws, All Exploitable, All Remote
WAVLINK is a budget networking hardware vendor. Their routers and access points are cheap, they are widely available, and they are deeply, catastrophically broken right now.
Between the 1st and 2nd of November 2026, the National Institute of Standards and Technology’s National Vulnerability Database published a cascade of critical CVEs affecting multiple WAVLINK device families. The affected models include the WL-WN579A3-A, the WL-WN530BE1-A, the WN579X3-D, the WL-WN530HG4B, the WN701AE, the WN553X1-B, and the WN536AX6-A. That is not one unlucky product line. That is a catalogue.
The vulnerability classes are textbook and brutal in combination.
Command injection is the dominant pattern. Functions across the web management interface, the OpenVPN handler, the WireGuard CLI group handler, and the ioos service backend all accept user-supplied arguments, things like network group names, IP address fields, and file identifiers, without properly sanitising them. An attacker who can reach the device over the network can inject operating system commands directly. The router executes them. The attacker now controls the device.
CVE-2026-120195, published on the 1st of November 2026, affects the Initial Setup Wizard of the WL-WN579A3-A. The argument is wlan_ssid. The CVSS score is 10.0. The exploit has been publicly disclosed. The vendor was contacted in advance and, in at least some cases documented across this batch, did not respond.
CVE-2026-120281, published on the 2nd of November 2026, adds a stack-based buffer overflow to the OpenVPN handler of the WN536AX6-A. Buffer overflows of this class can be used to overwrite memory in ways that allow arbitrary code execution, not just command injection. The CVSS score is again 10.0.
Also affected: the Linksys E8450, firmware version 1.2.00.360516. CVE-2026-120283, published on the 2nd of November 2026, describes a stack-based buffer overflow in the portal.cgi file triggered by manipulation of the hidden_timezone argument. The vendor was contacted and did not respond at all.
The pattern across this entire batch is consistent: the exploits are out, the vendors have been notified, patches are absent or unconfirmed for several affected models, and the attack surface is in thousands of small offices.
Why SMBs Are the Bullseye
Budget routers do not appear in enterprise procurement lists. They appear in small business networks because they are inexpensive, they work well enough day-to-day, and nobody is systematically auditing them.
The attack calculus here is not complicated. An attacker who exploits a WAVLINK device gains control of the network gateway. From there, the traffic of every device on that network is visible. Credentials transmitted over the network can be intercepted. Lateral movement to other devices becomes straightforward. A ransomware payload can be staged and deployed from a position of trust inside the network perimeter.
Small businesses also tend not to have the logging infrastructure to detect this kind of compromise promptly. The router runs. The internet works. Nobody notices anything is wrong until the ransom note appears, or until a client calls to say their data has shown up somewhere it should not be.
The fact that exploit code for these vulnerabilities is already public matters. Sophisticated nation-state actors are not required. Script-level automation against known-vulnerable firmware versions is well within the capability of opportunistic criminal groups.
Ivanti Connect Secure: Confirmed Active Exploitation
Separately, and with equal urgency: the US Cybersecurity and Infrastructure Security Agency added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalogue on the 31st of October 2026.
Ivanti Connect Secure is a VPN product used by organisations of all sizes, including smaller businesses and the managed service providers who serve them, to provide remote access to internal networks. Attackers have chained three flaws in the product to achieve unauthenticated root-level code execution. That means an attacker who can reach the Ivanti appliance over the internet does not need a username. They do not need a password. They get the keys to the kingdom.
The CISA KEV catalogue is not a theoretical risk register. Inclusion requires confirmed evidence of active exploitation in the wild. This is happening now.
For UK small businesses, the direct exposure depends on whether they or their MSP uses Ivanti Connect Secure specifically. Many MSPs standardise on a small set of remote access products, so if you do not know which VPN technology is protecting your remote workforce, that question needs an answer today.
The broader lesson is structural. VPN appliances are perimeter devices: they sit at the edge of your network precisely because they are supposed to be the secure gateway. When the gateway itself is compromised, the attacker is inside before any endpoint protection or firewall has a chance to respond. Perimeter devices require the same patching discipline as anything else, and in practice they are often neglected longer.
What This Means for Your Business
Check your hardware inventory today. If you do not have a written list of every network device on your premises, this week is the week you create one. Brand names, model numbers, firmware versions. WAVLINK and Linksys E8450 hardware should be flagged as urgent priorities.
If you have affected WAVLINK hardware, assume it is compromised until you can verify otherwise. The exploit code is public. The window between disclosure and active exploitation is measured in days, sometimes hours. If the device cannot be patched, isolate it from the rest of your network immediately and source a replacement. If you are running the WN536AX6-A, the WN553X1-B, the WN701AE, or any of the other affected models, treat this as an emergency, not a scheduled maintenance item.
Ask your MSP about Ivanti. If you use a managed service provider for remote access or network management, ask them directly which VPN product they use and whether it has been patched against the vulnerabilities added to the CISA KEV catalogue on the 31st of October 2026. A competent MSP will have an answer ready. If they do not, that is information too.
Segment your network where you can. If your guest Wi-Fi and your business Wi-Fi run through the same device, and that device is vulnerable, a compromise of the router exposes everything. Even basic network segmentation, keeping payment systems, client data, and operational systems on separate network segments, limits what an attacker can reach from a compromised gateway.
Log the access. Many small business routers can be configured to forward logs to an external service. If yours can, turn it on. Unexpected inbound connections, unusual outbound traffic patterns, and repeated authentication failures are the early signals that something is wrong.
How to Turn This Into a Competitive Advantage
Network security is a procurement question now. Contracts with larger clients, public sector bodies, and regulated industries increasingly include supplier security questionnaires. Being able to demonstrate that you maintain an accurate hardware inventory, that you apply firmware updates systematically, and that you follow NCSC guidance on network device management is a differentiator.
More practically: if you take the steps above before a competitor does, you are the business that does not make the news. In the context of supply chain attacks, where a small supplier is compromised specifically to gain access to their larger client’s systems, your network security posture is not just your problem. It is your clients’ problem too. Frame it that way when you are talking to them.
How to Sell This to Your Board
Three arguments that will land without requiring a technical audience.
First, the risk is current and quantified. More than 20 maximum-severity vulnerabilities affecting common networking hardware were published in a single day. The exploit code is already public. This is not a future risk being modelled. It is a present one being actively probed.
Second, the cost of action is low relative to the cost of inaction. Replacing a vulnerable router costs between £50 and £300 depending on the model. The average cost of a ransomware incident for a UK small business, including downtime, recovery, and reputational damage, runs to tens of thousands of pounds. The arithmetic is not complicated.
Third, your MSP has an obligation here. If you are paying for managed network services and your provider has not proactively flagged this, that is a conversation worth having. A managed service provider who is not monitoring the CISA KEV catalogue and acting on it within days of new entries is not providing what they are charging for.
Before You Go
If this briefing was useful, the best thing you can do is follow the show wherever you listen to podcasts, leave a rating or review, and drop a comment with your thoughts. If you know someone running a small business who should hear this, share it with them. The information is only useful if it reaches the people who need it.