CVE-2026-18589

Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow

View on CVE.org
Published Aug 3, 2026 CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed
Description
A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Analysis

AI-generated

Technical impact

The vulnerability resides in the change_password function of the nas.cgi script on the Wavlink WL‑NU516U1 router running firmware 708c073‑mt7628. By manipulating the User1Passwd argument, an attacker can overflow a stack buffer, potentially gaining arbitrary code execution or causing denial of service. This is a classic stack overflow weakness associated with CWE‑119 and CWE‑121.

Affected Systems

The flaw affects only the Wavlink WL‑NU516U1 model with firmware build 708c073‑mt7628. No other versions are listed as impacted. The vulnerable code lies within the device’s management interface exposed remotely via nas.cgi.

Risk and Exploitability

The CVSS score of 9.3 reflects critical severity. EPSS data is not available, yet the exploit is publicly documented and can be executed remotely through the web interface. The vulnerability is not currently listed in the CISA KEV catalog, but the combination of high CVSS, remote exploitability, and existence of a public exploit demands urgent remediation. The attack vector is inferred to be the device’s web management portal, where a crafted payload targeting the User1Passwd field can trigger the overflow.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the device to the latest firmware version released by Wavlink that contains the fix for the change_password buffer overflow.
  • If an immediate firmware update is not available, isolate the web management interface using a firewall or VPN so that only trusted administrators can reach it, thereby limiting exposure to the vulnerable endpoint.
  • As a temporary measure, disable remote password change functionality or apply firewall rules to block access to nas.cgi from untrusted networks.

Generated by OpenCVE AI on August 3, 2026 at 08:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wavlink wl-nu516u1
Vendors & Products Wavlink wl-nu516u1
Type Values Removed Values Added
Description A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Title Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow
First Time appeared Wavlink
Wavlink wl-nu516u1 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wl-nu516u1 Firmware
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Aug 3, 2026, 7:59 PM
Reserved
Aug 2, 2026, 8:33 PM

View source JSON

Updated
Aug 3, 2026, 7:59 PM

JSON

Status
Deferred
Published
Aug 3, 2026, 7:16 AM
Modified
Oct 23, 2026, 10:10 PM

View source JSON

No data.

Updated
Aug 3, 2026, 8:45 AM

JSON