Is there a public PoC exploit available for CVE-2026-15513?

Yes, a public proof-of-concept exploit is available for CVE-2026-15513. Prioritise patching immediately. EPSS: 1.4%.

Is there a patch available for CVE-2026-15513?

Yes, a patch is available for CVE-2026-15513. Update the affected software to the latest version immediately.

Wavlink WL-NU516U1 CVE-2026-15513

Q: What is the CVSS score of CVE-2026-15513?

CVE-2026-15513 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.4%.

EUVD-2026-43254 LOW

OS Command Injection (CWE-78)

2026-07-12 VulDB

GHSA-f39c-wxvq-c7vx

Command Injection Wl Nu516U1 Wavlink

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-accessible CGI endpoint requires low-privilege auth (PR:L); OS command injection on a router realistically yields full device control, warranting C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 13, 2026 - 00:22 NVD

MEDIUM LOW

CVSS changed

Jul 13, 2026 - 00:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 13, 2026 - 00:03 vuln.today

DescriptionCVE.org

A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lan_ip results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

OS command injection in the Wavlink WL-NU516U1 router's CGI web administration interface allows authenticated network attackers to execute arbitrary operating system commands by injecting shell metacharacters into the lan_ip parameter of the adm.cgi endpoint. The wlink_uci_set_value function passes attacker-controlled input unsanitized into OS-level commands, enabling full compromise of the underlying Linux-based router OS. A public proof-of-concept exploit is available on GitHub (no public exploit identified at time of analysis for KEV), and the vendor has released a patched firmware as of June 22, 2026.

Technical ContextAI

The Wavlink WL-NU516U1 is a SOHO router built on the MediaTek MT7628 chipset running an OpenWrt-derived firmware. Administrative functions are exposed through CGI scripts, specifically /cgi-bin/adm.cgi. The wlink_uci_set_value function - responsible for applying UCI (Unified Configuration Interface) network settings such as LAN IP configuration - fails to neutralize special shell characters in the lan_ip argument before constructing OS-level commands, constituting a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command). By injecting metacharacters such as semicolons, backticks, or pipes into the lan_ip parameter, an attacker breaks out of the intended command context and executes arbitrary payloads on the host OS. The affected product is identified by CPE cpe:2.3:a:wavlink:wl-nu516u1:*:*:*:*:*:*:*:*, with the wildcard version field indicating the flaw spans multiple firmware builds prior to the June 2026 patch.

RemediationAI

Upgrade to the vendor-patched firmware released June 22, 2026: WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin, available directly from Wavlink at https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin. As an interim measure prior to patching, disable WAN-side remote management to eliminate the network attack vector for external unauthenticated parties - note this does not protect against LAN-side authenticated attackers or the CSRF delivery path. Additionally, restrict access to /cgi-bin/adm.cgi to trusted management workstations via firewall rules or ACLs, and avoid accessing the router admin interface from browsers used for general web browsing to reduce CSRF exposure. Changing default credentials is advisable but does not remediate the injection flaw itself.