The vulnerability is located in the change_wifi_password function of the adm.cgi script on Wavlink NU516U1 routers. By manipulating the wl_channel, wl_Pass, or EncrypType parameters, an unauthenticated attacker can inject arbitrary operating‑system commands. This leads to full remote code execution on the device, allowing an attacker to modify configuration, install malware, or hijack the network. The weakness is a classic OS command injection identified as CWE‑77 and CWE‑78.

Affected devices are Wavlink NU516U1 routers running firmware M16U1_V240425. No additional version range was provided, but any device with the stated firmware build carries the flaw.

The CVSS score of 5.3 indicates moderate base severity, yet the nature of OS command injection is high impact. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, but the public disclosure and remote attack surface suggest a tangible risk. Exploitation requires network access to the device’s web interface, and the attacker does not need prior authentication. Given the potential for complete device compromise, the risk is significant for exposed devices.