A command‑injection flaw exists in the singlePortForwardDelete function of the Wavlink WL‑NU516U1 firewall firmware. Manipulating the del_flag argument allows an attacker to execute arbitrary shell commands on the device, resulting in full control over the system. This weakness falls under CWE‑74 and CWE‑77, and can compromise confidentiality, integrity, and availability of the device. The vulnerability is exploitable remotely, as documented attacks have already been published.

The flaw affects Wavlink WL‑NU516U1 units running firmware up to version 20251208. No newer firmware versions are listed as vulnerable. Any installation of the device with the affected firmware exposed to a network is susceptible.

The CVSS score of 8.6 indicates a high severity, while the very low EPSS (<1%) suggests that, so far, exploitation attempts are infrequent. The vulnerability is not included in the CISA KEV list. Attackers can leverage the exposed command injection over the network to run arbitrary commands, but the lack of widespread exploitation to date reduces immediate threat, though the potential impact remains severe.