EUVD-2026-40036
GHSA-ffh8-39gq-j894
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid admin credentials via default password or credential reuse
-
DeliverySend crafted HTTP POST to /cgi-bin/wireless.cgi
-
ExploitInject shell metacharacters in SSID2G2, SSID5G2, AuthMethod2, or WPAPSK12 parameter
-
Executionsub_401D68 passes unsanitized input to OS command invocation
-
PersistExecute arbitrary commands as router CGI process user
-
ImpactAchieve persistent device control or pivot to LAN
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires authenticated access to the device's web management interface - the CVSS 4.0 vector specifies PR:L, confirming that at least a low-privilege authenticated session is necessary. The vulnerable code path is triggered only when the Multi-SSID configuration endpoint (/cgi-bin/wireless.cgi) is reached via HTTP POST with at least one of the parameters SSID2G2, SSID5G2, AuthMethod2, or WPAPSK12 containing injected shell metacharacters. The device must be network-reachable by the attacker (AV:N). Exploitation is limited by: the PR:L authentication barrier (attacker must first obtain valid credentials, e.g., default admin credentials or a separately compromised account); the typical NAT deployment of consumer routers (admin interface not directly internet-exposed in most deployments); and the requirement to reach the specific CGI path, not just the device IP. No user interaction is required once authentication is achieved. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/E:P) with a score of 5.3 reflects the mitigating authentication requirement (PR:L) and the conservative VC:L/VI:L/VA:L impact rating applied by the reporter. However, command injection in embedded router firmware typically affords far greater OS-level control than the vendor-assigned L/L/L impact suggests - an independent assessment would place C:H/I:H/A:H on the vulnerable system. The E:P exploit maturity modifier confirms PoC code is publicly available, compressing the attacker skill barrier. KEV status is absent from the provided data, meaning widespread active exploitation is not confirmed. EPSS data was not provided, limiting probabilistic exploitation forecasting. Real-world risk is moderate-to-elevated for devices whose admin interface is internet-exposed, but substantially reduced for devices sitting behind NAT on home or small-office networks with no port-forwarding to the management plane. The vendor's rapid response and patch release are notable positive signals. |
| Exploit ScenarioDerived | An attacker who has obtained valid credentials to the Wavlink WL-NU516U1-A web administration panel - whether via credential stuffing, default password abuse, or prior compromise - submits a crafted HTTP POST request to /cgi-bin/wireless.cgi with shell metacharacters (e.g., a semicolon followed by an arbitrary command) embedded in the SSID2G2 or WPAPSK12 parameter. Function sub_401D68 passes the value unsanitized to an OS command invocation, causing arbitrary code to execute with the privileges of the CGI process on the router. Public PoC code hosted at the referenced GitHub repositories confirms this attack is reproducible with low skill requirements. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 29, 2026
Command injection in Wavlink WL-NU516U1-A router firmware (M16U1_V240425) allows authenticated remote attackers to execute arbitrary OS commands by submitting crafted POST parameters to the wireless CGI configuration handler. The affected function sub_401D68 within /cgi-bin/wireless.cgi fails to sanitize the SSID2G2, SSID5G2, AuthMethod2, and WPAPSK12 parameters before passing them to OS-level commands. A public proof-of-concept exploit is confirmed available on GitHub; this CVE is not currently listed in CISA's KEV catalog, but the vendor has already released a patched firmware.
RemediationAI
The primary remediation is to upgrade the WL-NU516U1-A firmware to the vendor-patched release dated 2026-06-22, downloadable directly from https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin. The vendor was noted to have responded rapidly and released this fix promptly. If immediate firmware update is not feasible, the highest-impact compensating control is to firewall or disable remote access to the device's web management interface - since PR:L authentication is required, preventing unauthenticated network access to the admin panel eliminates the primary attack path. If the Multi-SSID feature (secondary SSID configuration for SSID2G2 and SSID5G2) is not in active use, disabling it may reduce the attack surface exposed through this specific CGI handler, though the underlying code flaw persists. Changing the management interface to a non-default port does not constitute a security control. Full advisory context available via VulDB at https://vuldb.com/vuln/374546.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Wavlink WL-NU516U1-A is a consumer-grade wireless router/USB Wi-Fi device running embedded Linux firmware. The vulnerable component is /cgi-bin/wireless.cgi, a CGI script handling wireless multi-SSID configuration via HTTP POST requests. Specifically, function sub_401D68 processes secondary SSID configuration parameters - SSID2G2 (2.4GHz secondary SSID), SSID5G2 (5GHz secondary SSID), AuthMethod2 (authentication method), and WPAPSK12 (WPA pre-shared key) - without properly neutralizing shell metacharacters before invoking OS-level commands. This is a textbook CWE-77 (Improper Neutralization of Special Elements used in a Command) flaw. The CPE string cpe:2.3:a:wavlink:wl-nu516u1-a confirms NVD catalogues this as an application-layer flaw in the Wavlink WL-NU516U1-A product line.
Know when Wl Nu516U1 A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Authenticated network-exploitable command injection yields full OS command execution on the router, warranting C:H/I:H/A:H; PR:L reflects required authentication per CVSS 4.0 input vector.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in Wavlink WL-NU516U1-A M16U1_V240425. The affected element is the function sub_401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB