CVE-2026-8229

Wavlink NU516U1 wireless.cgi WifiBasic os command injection

View on CVE.org
Published May 10, 2026 CVSS 4.0 · 5.3 Medium EPSS 8.1% KEV · Not listed
Description
A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument AuthMethod/EncrypType results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

Analysis

AI-generated

Technical impact

The vulnerability is located in the WifiBasic function of /cgi-bin/wireless.cgi on the Wavlink NU516U1 router firmware 240425. Manipulation of the AuthMethod or EncrypType parameters allows an attacker to inject arbitrary operating‑system commands, enabling full remote code execution. An attacker who succeeds can read, modify, or delete data, tamper with the system, or launch further attacks, thereby compromising confidentiality, integrity, and availability of the device.

Affected Systems

Wavlink NU516U1, firmware version 240425.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity. The EPSS score of 9% suggests a moderate likelihood that attackers may exploit this vulnerability; however, the vulnerability is publicly known and can be exploited remotely through the router’s web interface. The vulnerability is not yet catalogued in CISA’s KEV list. The most likely attack vector is a remote attacker sending crafted HTTP requests to the wireless.cgi endpoint from outside the local network.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the router firmware to the latest release that includes a fix for the WifiBasic command injection.
  • If a firmware update is unavailable, disable remote management of wireless settings or block HTTP access to the /cgi-bin/wireless.cgi endpoint entirely.
  • Configure firewall or access control rules to restrict inbound traffic to the router’s web interface so that only trusted networks can reach the vulnerable CGI script.

Generated by OpenCVE AI on September 26, 2026 at 07:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Wavlink wl-nu516u1 Firmware
CPEs cpe:2.3:h:wavlink:wl-nu516u1:-:*:*:*:*:*:*:*
cpe:2.3:o:wavlink:wl-nu516u1_firmware:m16u1_v240425:*:*:*:*:*:*:*
Vendors & Products Wavlink wl-nu516u1 Firmware
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wavlink
Wavlink wl-nu516u1
Vendors & Products Wavlink
Wavlink wl-nu516u1
Type Values Removed Values Added
Description A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument AuthMethod/EncrypType results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Title Wavlink NU516U1 wireless.cgi WifiBasic os command injection
Weaknesses CWE-77
CWE-78
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 11, 2026, 3:00 PM
Reserved
May 9, 2026, 7:54 AM

View source JSON

Updated
May 11, 2026, 3:00 PM

JSON

Status
Analyzed
Published
May 10, 2026, 5:16 AM
Modified
Jul 24, 2026, 7:10 AM

View source JSON

No data.

Updated
Sep 26, 2026, 7:30 AM

JSON