A vulnerability exists in the Wavlink WL‑NU516U1 router’s adm.cgi script; manipulating the Pr_mode argument in the usb_p910 function leads to execution of arbitrary shell commands on the device. The flaw is rooted in improper input handling (CWE‑74, CWE‑77). An attacker who can reach the router’s web administration interface can exploit the injection without needing local privileges, enabling full remote compromise of the device and related network.

Systems affected are Wavlink WL‑NU516U1 routers running firmware version 240425. The issue is confined to the usb_p910 handler in /cgi-bin/adm.cgi; other firmware revisions or models are not reported to be impacted.

The CVSS base score of 5.1 denotes moderate risk, and the EPSS score of less than 1% points to a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog, but it has been publicly disclosed and an attacker can launch the exploit over the network using the HTTP administration interface. Authentication requirements are not stated in the description; the lack of an explicit requirement suggests that the vulnerable endpoint may be accessible without authentication, which would increase the attack surface. Until a patch is applied, the risk remains that an attacker could execute commands remotely on the device.