The vulnerability resides in the sub_405B2C function of /cgi-bin/firewall.cgi on the Wavlink NU516U1 router, allowing an attacker to inject arbitrary shell commands through crafted requests. The flaw maps to CWE-74 (Command Injection) and CWE-77 (Improper Validation of Inherited Environment Variables). Based on the description, it is inferred that successful exploitation could give the attacker control over the device’s operating system, potentially enabling data exfiltration, covert persistence, or lateral movement into the network segment the router protects. The vulnerability explicitly states that the attack can be initiated remotely, indicating the affected CGI endpoint is exposed over the network.

Affected hardware includes the Wavlink NU516U1 router with firmware build 251208. The web interface exposes a CGI script at /cgi-bin/firewall.cgi that processes requests from the router’s management portal. The CPEs for the affected product are wvlink:wl‑nu516u1 firmware version 251208 and the device hardware identifier wl‑nu516u1.

The CVSS score of 5.1 places the vulnerability in the medium severity range. The EPSS score is less than 1 %, suggesting that exploitation attempts are currently rare or opportunistic. The issue is not listed in the CISA KEV catalog. Although the description confirms public disclosure and remote attack potential, the lack of an explicit authentication requirement implies that a malware- or bot-driven attack could target any device with its web interface exposed to the internet. Consequently, organizations that leave the NU516U1 router’s management interface reachable from untrusted networks face a nontrivial risk, even though the likelihood of widespread exploitation appears low at present.