The vulnerability resides in the function sub_401A0C within the /cgi-bin/login.cgi script of the Wavlink WL-NU516U1 V240425 firmware. Manipulating the ipaddr argument results in a stack-based buffer overflow (CWE-119/121). The official description does not explicitly state the resulting impact beyond the overflow, but the nature of the flaw suggests that code execution could be possible if the overflow is fully leveraged. The CVE note that the attack can be launched remotely does not confirm exploitation outcomes, so the precise impact remains inferred.

Wavlink WL-NU516U1 routers running firmware version V240425 are affected. No other vendors or product lines are listed in the CVE data.

The CVSS score of 8.6 denotes a high severity level. EPSS is below 1%, indicating a low but non-zero probability of exploitation; the vulnerability is not currently cataloged in the CISA KEV list. Public exploit code exists and the flaw can be triggered remotely via the login.cgi interface without requiring privileged access, which could allow attackers to attempt exploitation over the network.