The vulnerability exists in the OTA Online Upgrade component of Wavlink WL-NU516U1, specifically in the sub_405AF4 function of adm.cgi. By manipulating the firmware_url argument, an attacker can inject shell commands that the router will execute, leading to remote command execution. This is a classic instance of a command injection flaw and falls under CWE-74 and CWE-77. With successful exploitation, an attacker would gain the ability to run arbitrary commands on the device, potentially compromising the router, exfiltrating configuration data, or using it as a foothold within the local network.

The affected vendor is Wavlink and the product is the WL‑NU516U1 router model. The specific firmware build impacted is V240425, as identified in the advisory. Any devices running this firmware revision are vulnerable unless the firmware is updated or the feature disabled.

The CVSS score of 8.6 classifies this as a high severity flaw, while the EPSS score of less than 1% indicates a very low yet non‑zero probability of widespread exploitation at the time of this assessment. It is not listed in the CISA KEV catalog. The remote nature of the attack combined with the lack of authentication on the adm.cgi endpoint means that an attacker who can reach the device over HTTP will be able to craft a request that triggers the command injection. Although the likelihood of exploitation is currently low, the potential impact remains significant.