The flaw resides in the wzdrepeater function of the /cgi-bin/adm.cgi script on Wavlink NU516U1 routers. By manipulating the wlan_bssid, sel_Automode, or sel_EncrypTyp parameters, an attacker can inject operating‑system commands, leading to arbitrary command execution on the device. This weakness is a classic example of CWE‑77 (OS Command Injection) and CWE‑78 (OS Command Execution) weaknesses.

Affected devices are Wavlink NU516U1 routers running firmware version M16U1_V240425. No other versions are explicitly listed in the advisory, so the scope is limited to this model and firmware build.

The CVSS score is 5.3, indicating moderate severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified from this advisory alone. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly confirmed exploitation yet. However, the description states the exploit has been made public, meaning a remote attacker with network access to the router’s administrative interface could potentially trigger the injection simply by sending crafted HTTP requests.