The vulnerability resides in the "wzdapMesh" function of the /cgi-bin/adm.cgi web interface on Wavlink NU516U1 devices. Manipulating input to this endpoint allows an attacker to inject arbitrary operating‑system commands. Once executed, the attacker can modify or read system files, disrupt network services, or use the device as a foothold for further attacks. This aligns with CWE‑77 (command injection) and CWE‑78 (OS command injection). The fact that the exploit has been made available to the public indicates that the flaw is actionable in real‑world scenarios.

Only the Wavlink NU516U1 firmware build 240425 is confirmed to be vulnerable. No other versions or models are listed as affected.

The CVSS score of 5.3 reflects moderate severity, but the lack of an EPSS value and its absence from the KEV list suggests exploitation is not currently widespread. Nevertheless, the remote nature of the input vector and the availability of a public exploit mean that an adversary could trigger the vulnerability from outside the local network if the admin interface is reachable.