The flaw resides in the ota_new_upgrade function of the adm.cgi script on the Wavlink WL-NU516U1 router. By manipulating the model argument, an attacker can inject shell metacharacters, resulting in arbitrary command execution. The vulnerability exposes the device to compromise of confidentiality, integrity, and availability, allowing a remote actor to run commands with the privileges of the web server process.

The attack targets Wavlink WL-NU516U1 devices running firmware version 240425. All units identified by the model number WL-NU516U1 and bearing this firmware release are susceptible.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1% suggests low yet nonzero exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but publicly available exploit code demonstrates its feasibility. The likely attack vector is a remote HTTP request to /cgi-bin/adm.cgi containing a crafted model parameter; authentication requirements, if any, are not specified in the provided data and are therefore inferred as minimal or absent.