The vulnerability exists in the OTA Online Upgrade component of Wavlink WL‑NU516U1, specifically in the sub_405AF4 function of adm.cgi. By manipulating the firmware_url argument, an attacker can inject shell commands that the router will execute, leading to remote command execution. This is a classic instance of a command injection flaw and falls under CWE-74 and CWE-77. Based on the description, it is inferred that the attacker can reach the adm.cgi endpoint remotely over HTTP, allowing them to run arbitrary commands on the device, potentially compromising the router, exfiltrating configuration data, or using it as a foothold within the local network.

The affected vendor is Wavlink and the product is the WL‑NU516U1 router model. The specific firmware build impacted is V240425, as identified in the advisory. Any devices running this firmware revision are vulnerable unless the firmware is updated or the feature disabled.

The CVSS score of 8.6 classifies this as a high severity flaw, while the EPSS score of 13% indicates a notable probability of widespread exploitation at this time. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker can reach the adm.cgi endpoint remotely over HTTP, allowing them to craft a request that triggers the command injection. The remote nature of the attack combined with the fact that the adm.cgi endpoint is publicly reachable (no explicit authentication requirement is stated in the description) means that an attacker who can reach the device over HTTP would be able to exploit the vulnerability. Although the likelihood of exploitation is currently higher, the potential impact remains significant.