Which versions of Wavlink WL-NU516U1-A are affected by CVE-2026-13539?

The Wavlink WL-NU516U1-A wireless range extender (firmware M16U1_V240425) contains a remote buffer overflow vulnerability in the wireless configuration interface exploitable via publicly available…. A patch is available.

Is there a public PoC exploit available for CVE-2026-13539?

Yes, a public proof-of-concept exploit is available for CVE-2026-13539. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-13539?

Within 24 hours: Inventory all Wavlink WL-NU516U1-A range extenders and segregate any running firmware M16U1_V240425 from critical network segments. Review access logs for suspicious POST requests to /cgi-bin/wireless.cgi. Within 7 days: Contact Wavlink support for latest firmware patch, test in staging environment, and begin deployment across identified devices. Within 30 days: Verify all devices updated to patched firmware, complete remediation documentation, and implement network segmentation policy for wireless infrastructure devices.

Wavlink WL-NU516U1-A CVE-2026-13539

Q: What is the CVSS score of CVE-2026-13539?

CVE-2026-13539 has a CVSS 4.0 base score of 7.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-40037 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-29 VulDB

GHSA-w62x-cjgj-j8jh

Buffer Overflow Stack Overflow Wl Nu516U1 A Wavlink

7.4

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

7.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable CGI handler with low complexity and no user interaction, but PR:L since web-interface authentication is required; memory corruption yields high C/I/A with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 29, 2026 - 07:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 29, 2026 - 07:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 29, 2026 - 07:37 vuln.today

cvss_changed

CVSS changed

Jun 29, 2026 - 07:37 NVD

8.7 (HIGH) 7.4 (HIGH)

Analysis Generated

Jun 29, 2026 - 07:15 vuln.today

DescriptionCVE.org

A vulnerability was identified in Wavlink WL-NU516U1-A M16U1_V240425. The impacted element is the function sub_407504 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. Such manipulation of the argument Guest_ssid leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

Stack-based buffer overflow in the Wavlink WL-NU516U1-A wireless range extender (firmware M16U1_V240425) lets a remote, low-privileged attacker corrupt memory by sending an oversized Guest_ssid POST parameter to the sub_407504 function in /cgi-bin/wireless.cgi. The flaw was reported by VulDB, publicly available exploit code exists, and it carries a CVSS 4.0 base score of 7.4; there is no evidence of active exploitation in CISA KEV at this time.

Technical ContextAI

The affected device is a Wavlink WL-NU516U1-A USB/wireless networking device running embedded MediaTek MT7628-based firmware (the patched image is an mt7628 squashfs sysupgrade), with a CGI-based web management interface. The vulnerability sits in the POST parameter handler routine sub_407504 within /cgi-bin/wireless.cgi, which processes the Guest_ssid (guest Wi-Fi SSID) argument. Per CWE-121 (Stack-based Buffer Overflow), the root cause is copying attacker-controlled input into a fixed-size stack buffer without bounds checking, allowing the stack frame (including saved return address) to be overwritten. On these MIPS-based SOHO devices, web CGI handlers typically run with high privilege, so memory corruption here can translate into control-flow hijacking or service crash.

RemediationAI

Vendor-released patch: apply the fixed Wavlink firmware image dated 2026-06-22 (WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin) available at https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin; the vendor responded professionally and quickly released this fix. Until the firmware is applied, restrict access to the device's web management interface to trusted hosts only and avoid exposing the management port to untrusted networks or the internet (trade-off: legitimate remote administration is also blocked), and disable or avoid configuring the guest Wi-Fi SSID feature that reaches the vulnerable Guest_ssid handler if it is not required (trade-off: loss of guest network functionality). Change any default or weak web-interface credentials, since exploitation requires low-privilege authenticated access. Refer to https://vuldb.com/cve/CVE-2026-13539 for tracking.