Description
A weakness has been identified in Wavlink WL-NU516U1 260227. This vulnerability affects the function ftext of the file /cgi-bin/nas.cgi. This manipulation of the argument Content-Length causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-26
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via Stack-Based Buffer Overflow
Action: Immediate Patch
AI Analysis

Impact

Wavlink WL-NU516U1 devices running firmware 260227 are vulnerable due to a stack-based buffer overflow in the ftext function of /cgi-bin/nas.cgi. The vulnerability is triggered by manipulating the Content-Length HTTP header, allowing an attacker to overflow a buffer on the server-side stack. If successfully exploited, this can lead to arbitrary code execution, compromise of the device, data leakage, or denial of service. The weakness is classified under CWE-119 and CWE-121, indicating a classic memory corruption and stack frame tampering scenario.

Affected Systems

The affected product is Wavlink WL-NU516U1 NAS units, specifically the firmware version 260227. Other firmware revisions are not known to be impacted, but all devices from the WL-NU516U1 line should be considered potentially vulnerable until verified.

Risk and Exploitability

The CVSS score for this flaw is 8.7, indicating high severity. No EPSS score is available, and the vulnerability is not listed as a known exploited vulnerability (KEV). The attack can be launched remotely by sending crafted HTTP requests to the /cgi-bin/nas.cgi endpoint. An attacker must have network connectivity to the NAS, and no authentication is required. Because the exploit code has been published publicly, the risk to exposed devices is significant.

Generated by OpenCVE AI on March 26, 2026 at 09:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify the current firmware version and upgrade to the latest available release if one exists. If no newer firmware is available, block external access to /cgi-bin/nas.cgi using firewall rules or device access control lists. Monitor logs for abnormal HTTP requests with unusual Content-Length values that target nas.cgi. Contact Wavlink support to request a patch or temporary mitigation and document the request. When a vendor patch is released, apply it immediately and verify the vulnerability is resolved.

Generated by OpenCVE AI on March 26, 2026 at 09:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 26 Mar 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 26 Mar 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Wavlink wl-nu516u1
Vendors & Products Wavlink wl-nu516u1

Thu, 26 Mar 2026 08:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Wavlink WL-NU516U1 260227. This vulnerability affects the function ftext of the file /cgi-bin/nas.cgi. This manipulation of the argument Content-Length causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Wavlink WL-NU516U1 nas.cgi ftext stack-based overflow
First Time appeared Wavlink
Wavlink wl-nu516u1 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wl-nu516u1 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Wavlink Wl-nu516u1 Wl-nu516u1 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-26T18:28:13.605Z

Reserved: 2026-03-25T16:31:03.203Z

Link: CVE-2026-4861

cve-icon Vulnrichment

Updated: 2026-03-26T18:28:10.335Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-03-26T09:16:06.720

Modified: 2026-03-30T13:26:50.827

Link: CVE-2026-4861

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-26T12:08:12Z

Weaknesses