A remote attacker can manipulate the skiplist1 or skiplist2 query parameters of the adm.cgi wifi_region function on the Wavlink NU516U1 router, enabling OS command injection that yields arbitrary command execution on the device’s operating system. The vulnerability exploits weaknesses in command construction (CWE‑77/78) and could be triggered without local access if the web administration interface is exposed to the Internet.

The flaw exists in the Wavlink NU516U1 router running firmware M16U1_V240425. Any deployment that enables the adm.cgi web‑management interface, particularly over untrusted networks, is susceptible. Devices without remote administration turned off or without authentication controls face higher risk.

The CVSS score of 5.3 indicates medium severity, while the EPSS score of 5% shows a modest probability of exploitation. An exploit is publicly available, which raises the likelihood of real‑world attacks, but the vulnerability is not yet included in CISA’s KEV catalog. The attack can be launched remotely by sending crafted HTTP requests to the admin interface; if authentication is required, the attacker must bypass or abuse authentication mechanisms. Overall, the risk is moderate, with a realistic threat to exposed devices.