Description
A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. Affected by this issue is the function wan of the file /cgi-bin/adm.cgi. This manipulation of the argument ppp_username/ppp_passwd/rwan_ip/rwan_mask/rwan_gateway is directly passed by the attacker/so we can control the ppp_username/ppp_passwd/rwan_ip/rwan_mask/rwan_gateway causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Published: 2026-05-09
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability exists in the wan function of /cgi-bin/adm.cgi on Wavlink NU516U1 routers. By manipulating the ppp_username, ppp_passwd, rwan_ip, rwan_mask, or rwan_gateway parameters, an attacker can inject arbitrary operating system commands. The attacker can then execute those commands remotely with the privileges of the web interface process, potentially taking control of the device, exfiltrating data, or using the router as part of a larger attack chain.

Affected Systems

The flaw was found on Wavlink NU516U1 devices running the M16U1_V240425 firmware release. No other product or version information is listed.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate overall risk. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The attack vector is inferred to be remote over the network, requiring the attacker to send a crafted HTTP request to the device’s administrative interface. While the vulnerability is publicly disclosed, there are no confirmed large-scale attacks reported in the public record.

Generated by OpenCVE AI on May 9, 2026 at 18:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the router firmware to the latest release that includes the fix for the adm.cgi command injection issue.
  • Restrict external access to the /cgi-bin/adm.cgi endpoint by configuring firewall rules or placing the device behind an internal network segment.
  • Use strong administrator credentials and enable any available multi‑factor authentication to reduce the risk of successful exploitation.

Generated by OpenCVE AI on May 9, 2026 at 18:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 09 May 2026 17:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. Affected by this issue is the function wan of the file /cgi-bin/adm.cgi. This manipulation of the argument ppp_username/ppp_passwd/rwan_ip/rwan_mask/rwan_gateway is directly passed by the attacker/so we can control the ppp_username/ppp_passwd/rwan_ip/rwan_mask/rwan_gateway causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Title Wavlink NU516U1 adm.cgi wan os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-05-09T17:15:08.656Z

Reserved: 2026-05-08T19:52:08.350Z

Link: CVE-2026-8190

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-05-09T18:16:22.293

Modified: 2026-05-09T18:16:22.293

Link: CVE-2026-8190

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-09T18:30:37Z

Weaknesses