CVE-2026-8228

Wavlink NU516U1 wireless.cgi advance os command injection

View on CVE.org
Published May 10, 2026 CVSS 4.0 · 5.3 Medium EPSS 7.8% KEV · Not listed
Description
A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlan_conf/Channel/skiplist/ieee_80211h leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Analysis

AI-generated

Technical impact

A flaw in the advance function of /cgi-bin/wireless.cgi on the Wavlink NU516U1 router allows an attacker to manipulate the wlan_conf/Channel/skiplist/ieee_80211h argument and inject arbitrary shell commands. The injected commands are executed with the privileges of the router’s operating system. This is a classic operating‑system command injection vulnerability (CWE‑77/78).

Affected Systems

The vulnerability affects the Wavlink NU516U1 model running firmware release 240425. No other vendors or product versions are listed as impacted.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of 9% suggests a moderate likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, requiring network access to the router's web interface. No evidence of active exploitation is reported, but the publicly disclosed exploit demonstrates the feasibility of remote command execution on this device.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the vendor’s website or support portal for any firmware releases that address the command injection flaw and plan to deploy them as soon as possible.
  • Restrict external access to the router’s management interface by configuring firewall rules or access control lists that allow only trusted internal IP addresses, thereby limiting the exposure of the vulnerable CGI endpoint.
  • If the wireless functionality is unnecessary, disable it or block the /cgi-bin/wireless.cgi endpoint using the router’s firewall or interface‑level restrictions to remove the attack surface.

Generated by OpenCVE AI on September 26, 2026 at 07:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Wavlink wl-nu516u1 Firmware
CPEs cpe:2.3:h:wavlink:wl-nu516u1:-:*:*:*:*:*:*:*
cpe:2.3:o:wavlink:wl-nu516u1_firmware:m16u1_v240425:*:*:*:*:*:*:*
Vendors & Products Wavlink wl-nu516u1 Firmware
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wavlink
Wavlink wl-nu516u1
Vendors & Products Wavlink
Wavlink wl-nu516u1
Type Values Removed Values Added
Description A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlan_conf/Channel/skiplist/ieee_80211h leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Title Wavlink NU516U1 wireless.cgi advance os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 12, 2026, 2:33 AM
Reserved
May 9, 2026, 7:54 AM

View source JSON

Updated
May 12, 2026, 2:33 AM

JSON

Status
Analyzed
Published
May 10, 2026, 5:16 AM
Modified
Jul 24, 2026, 7:10 AM

View source JSON

No data.

Updated
Sep 26, 2026, 7:30 AM

JSON