Is there a public PoC exploit available for CVE-2026-13538?

Yes, a public proof-of-concept exploit is available for CVE-2026-13538. Prioritise patching immediately. EPSS: 1.3%.

Is there a patch available for CVE-2026-13538?

Yes, a patch is available for CVE-2026-13538. Update the affected software to the latest version immediately.

Wavlink WL-NU516U1-A CVE-2026-13538

Q: What is the CVSS score of CVE-2026-13538?

CVE-2026-13538 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.3%.

EUVD-2026-40036 LOW

Command Injection (CWE-77)

2026-06-29 VulDB

GHSA-ffh8-39gq-j894

Command Injection Wl Nu516U1 A Wavlink

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Authenticated network-exploitable command injection yields full OS command execution on the router, warranting C:H/I:H/A:H; PR:L reflects required authentication per CVSS 4.0 input vector.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 29, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Jun 29, 2026 - 06:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 29, 2026 - 05:48 vuln.today

DescriptionCVE.org

A vulnerability was determined in Wavlink WL-NU516U1-A M16U1_V240425. The affected element is the function sub_401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

Command injection in Wavlink WL-NU516U1-A router firmware (M16U1_V240425) allows authenticated remote attackers to execute arbitrary OS commands by submitting crafted POST parameters to the wireless CGI configuration handler. The affected function sub_401D68 within /cgi-bin/wireless.cgi fails to sanitize the SSID2G2, SSID5G2, AuthMethod2, and WPAPSK12 parameters before passing them to OS-level commands. A public proof-of-concept exploit is confirmed available on GitHub; this CVE is not currently listed in CISA's KEV catalog, but the vendor has already released a patched firmware.

Technical ContextAI

The Wavlink WL-NU516U1-A is a consumer-grade wireless router/USB Wi-Fi device running embedded Linux firmware. The vulnerable component is /cgi-bin/wireless.cgi, a CGI script handling wireless multi-SSID configuration via HTTP POST requests. Specifically, function sub_401D68 processes secondary SSID configuration parameters - SSID2G2 (2.4GHz secondary SSID), SSID5G2 (5GHz secondary SSID), AuthMethod2 (authentication method), and WPAPSK12 (WPA pre-shared key) - without properly neutralizing shell metacharacters before invoking OS-level commands. This is a textbook CWE-77 (Improper Neutralization of Special Elements used in a Command) flaw. The CPE string cpe:2.3:a:wavlink:wl-nu516u1-a confirms NVD catalogues this as an application-layer flaw in the Wavlink WL-NU516U1-A product line.

RemediationAI

The primary remediation is to upgrade the WL-NU516U1-A firmware to the vendor-patched release dated 2026-06-22, downloadable directly from https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin. The vendor was noted to have responded rapidly and released this fix promptly. If immediate firmware update is not feasible, the highest-impact compensating control is to firewall or disable remote access to the device's web management interface - since PR:L authentication is required, preventing unauthenticated network access to the admin panel eliminates the primary attack path. If the Multi-SSID feature (secondary SSID configuration for SSID2G2 and SSID5G2) is not in active use, disabling it may reduce the attack surface exposed through this specific CGI handler, though the underlying code flaw persists. Changing the management interface to a non-default port does not constitute a security control. Full advisory context available via VulDB at https://vuldb.com/vuln/374546.