Technical impact
The vulnerability lies in the wzdapMesh function of /cgi-bin/adm.cgi on Wavlink NU516U1 routers. It allows an attacker to submit crafted input that triggers an operating‑system command injection (CWE‑77, CWE‑78). The CVE description confirms that arbitrary OS commands can be executed remotely. While the description does not list the exact consequences, it is inferred that, once executed, an attacker could potentially read, modify, or delete system files, disrupt network services, or use the device as a foothold for further attacks. These potential impacts are not explicitly stated but are typical for command‑injection flaws.
Affected Systems
Only the Wavlink NU516U1 model with firmware build 240425 is explicitly marked as vulnerable. No other firmware revisions or device variants are listed as affected, so administrators should confirm the exact firmware version on their network equipment.
Risk and Exploitability
The CVSS score of 5.3 indicates a moderate severity in terms of confidentiality, integrity, and availability. The EPSS score of 9% shows that exploitation is not yet widespread, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the attack vector is remote – the web‑based /cgi-bin/adm.cgi interface can be accessed from outside the local network if not properly restricted. Because a public exploit is available, an adversary could trigger the injection from untrusted networks, making the risk non‑negligible in environments where the admin interface is exposed.
