A flaw exists in the function sub_404F68 of the /cgi-bin/login.cgi file on Wavlink WL‑NU516U1 firmware 240425. Manipulating the homepage/hostname parameter triggers a client‑side cross‑site scripting vulnerability that can be exploited remotely. An attacker may inject malicious scripts into the browser of anyone who accesses the affected login page, potentially enabling cookie theft, session hijacking or additional client‑side attacks. The weakness is identified as CWE‑79, with an additional CWE‑94 reference that may relate to code injection possibilities.

The vulnerability affects Wavlink WL‑NU516U1 routers running firmware version 240425. The CPE string cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:* points to this specific device model and firmware, with no narrower sub‑version scope provided.

The CVSS score is 5.1, indicating moderate severity, while the EPSS score is below 1 % and the issue is not listed in the CISA KEV catalog. However, exploit code has been released publicly, increasing the likelihood of real‑world attacks. The attack vector is Remote – an adversary only needs to send a crafted HTTP request to the /cgi-bin/login.cgi endpoint. The impact is limited to the client’s browser and does not provide privilege escalation on the device. The risk is therefore primarily for users who interact with the login page, but the presence of a public exploit raises the overall threat level.