A remote attacker can manipulate the skiplist1 or skiplist2 parameters of the adm.cgi wifi_region function on the Wavlink NU516U1 router, triggering OS command injection and allowing arbitrary command execution on the device's operating system.

The flaw is present in the Wavlink NU516U1 router, specifically firmware version M16U1_V240425. Users who expose the router’s web administration interface to the Internet or who lack proper access controls are vulnerable.

The CVSS score of 5.3 indicates medium severity. EPSS data is unavailable but a publicly available exploit exists, and the vulnerability is not listed in CISA’s KEV catalog. The attack path involves sending crafted request parameters to adm.cgi over the network; if authentication is required, credentials for the administrative interface would need to be compromised. The known exploit and public availability imply a realistic risk of exploitation, especially on devices with remote management enabled.