The vulnerability resides in the set_sys_adm function of the adm.cgi admin password handler on Wavlink WL‑NU516U1. According to the description, improper sanitization of user‑supplied input allows an attacker to inject arbitrary operating‑system commands, effectively granting remote code execution. The weakness corresponds to CWE‑77 and CWE‑78. The impact is the potential compromise of the device, with full control over the underlying firmware and network traffic.

Affected devices are Wavlink WL‑NU516U1 routers running firmware build 708c073‑mt7628. The vulnerability is triggered by requests to the adm.cgi endpoint used for managing administrator passwords. The vendor has released a fixed firmware version after the issue was reported.

The CVSS score is 5.3, indicating a moderate severity; EPSS score is 1%, indicating a low probability of exploitation, and the CVE is not listed in the CISA KEV catalog. Public disclosure means the exploit is known to be feasible. An attacker with network access to the router’s administration interface can send crafted input to the set_sys_adm endpoint, potentially executing any OS command. The risk is significant for exposed routers, especially those accessible from the Internet or untrusted networks.