Wavlink WL-NU516U1-A CVE-2026-13539

Exploitation requires reaching the /cgi-bin/wireless.cgi endpoint and submitting an oversized Guest_ssid POST parameter to the sub_407504 handler on a Wavlink WL-NU516U1-A running firmware M16U1_V240425. The CVSS vector's PR:L means the attacker needs low-level authenticated access to the device's web management interface (not anonymous), which is the primary limiting factor; AC:L and UI:N mean that once that access exists no special timing or victim interaction is needed. Network reachability to the device's HTTP management interface is also required, so devices that do not expose the management UI to the attacker's network are protected. Exploitation is constrained to the specific affected device model and the vulnerable firmware version.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high confidentiality, integrity, and availability impact to the vulnerable system (VC:H/VI:H/VA:H) and no scope change to other systems - yielding 7.4 (High). The vector's E:P (Proof-of-Concept) aligns with the reported publicly available exploit on GitHub, raising practical risk. However, PR:L indicates the attacker must already hold some authenticated access to the device's web interface (e.g., a valid/guest or default credential session), which limits unauthenticated mass exploitation. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no confirmation of widespread or active exploitation; this currently reads as a real but bounded risk weighted heavily by the existence of POC code rather than confirmed in-the-wild use. EPSS data is missing - verify probability separately before final prioritization.

An attacker with low-privilege access to the device's web interface (for example via default or guest credentials, or an exposed management page) sends a crafted POST request to /cgi-bin/wireless.cgi with an overlong Guest_ssid value. This overflows a fixed-size stack buffer in sub_407504, crashing the service or potentially redirecting execution to attacker-controlled code; a public proof-of-concept for this exact path is available on GitHub.