A flaw in the /cgi-bin/login.cgi function sub_401A10 on the Wavlink NU516U1 model 251208 allows a remote attacker to perform an out‑of‑bounds write by manipulating the ipaddr argument. This is a classic buffer overflow (CWE‑119 and CWE‑787). The corrupted memory can lead to arbitrary code execution or system compromise, jeopardizing confidentiality, integrity, and availability of the device and potentially any networks it connects to.

The vulnerability affects all deployed Wavlink NU516U1 routers running firmware version 251208. This includes the hardware model NU516U1, a consumer‑grade wireless access point. No other firmware revisions or hardware variants are listed as affected.

The CVSS score of 9.3 signals critical severity, and the exploit can be triggered remotely without prior authentication. Although the EPSS score is below one percent, indicating a low current exploitation probability, published proof‑of‑concept code and a publicly available exploit raise the attack likelihood, especially if devices remain on older firmware. The vulnerability is not yet catalogued in CISA’s KEV list, but its high impact warrants immediate attention. Attackers can target the login CGI endpoint from outside the local network, sending specially crafted ipaddr parameters to overflow the buffer and gain code execution privileges.