A stack‑based buffer overflow was discovered in the sub_401218 function of the Wavlink WL‑NU516U1 firmware 20251208. The flaw is triggered by manipulating the User1Passwd argument supplied to the /cgi-bin/nas.cgi CGI script. By overflowing the stack buffer, an attacker can overwrite control data on the stack and potentially execute arbitrary code. The vulnerability is remotely exploitable, meaning only network access to the device is required to send a crafted request.

The affected product is the Wavlink WL‑NU516U1 network attached storage appliance running firmware version 20251208. The issue resides in the /cgi-bin/nas.cgi component of the device. Users operating that model with the specified firmware are potentially vulnerable. No other vendors or products are listed in the CVE data.

The CVSS base score of 8.6 indicates high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Because the flaw allows remote exploitation via HTTP requests, an attacker who can reach the device from outside the local network could potentially gain code execution if the NAS is exposed. The description implies that an attacker would need to supply a specially crafted User1Passwd parameter to trigger the overflow, but no public proof‑of‑concept is referenced, so the practical exploitability remains somewhat uncertain.