Is there a patch available for CVE-2026-18587?

Yes, a patch is available for CVE-2026-18587. Update the affected software to the latest version immediately.

Wavlink WL-NU516U1 CVE-2026-18587

Q: What is the CVSS score of CVE-2026-18587?

CVE-2026-18587 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.3%.

EUVD-2026-52160 MEDIUM

OS Command Injection (CWE-78)

2026-08-03 VulDB

GHSA-g32f-8qr6-x525

Command Injection Wl Nu516U1 Wavlink

6.8

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

6.8 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable Config Import with no stated authentication (PR:N), high complexity conditions (AC:H), user interaction needed (UI:R), and full system-level command execution impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 07:22 vuln.today

Severity Changed

Aug 03, 2026 - 07:22 NVD

HIGH MEDIUM

CVSS changed

Aug 03, 2026 - 07:22 NVD

7.7 (HIGH) 6.8 (MEDIUM)

DescriptionCVE.org

A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been published and may be used. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

OS command injection in the Wavlink WL-NU516U1 firmware (build 708c073-mt7628) allows remote attackers to execute arbitrary operating system commands by supplying a crafted Password argument to the Config Import component. The CVSS 4.0 score of 7.7 reflects meaningful constraints - high attack complexity (AC:H) and required user interaction (UI:P) - yet the full confidentiality, integrity, and availability impact on the vulnerable system remains high. A proof-of-concept exploit has been publicly published on GitHub, and the vendor has already released a patched firmware binary, making this a time-sensitive patching priority for any deployment of the affected firmware build.

Technical ContextAI

The Wavlink WL-NU516U1 is an embedded network device built on the MediaTek MT7628 SoC, commonly used in budget networking hardware running a stripped Linux environment. The Config Import feature allows users to upload or submit configuration data including credentials. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) is the root cause: the Password argument provided during config import is passed into a shell execution context without adequate sanitization or escaping, allowing injection of arbitrary shell metacharacters. This pattern is endemic to embedded firmware where web-based admin interfaces call shell utilities directly. The affected CPE is cpe:2.3:a:wavlink:wl-nu516u1:*:*:*:*:*:*:*:*, with the specific affected firmware build identified as 708c073-mt7628 per EUVD-2026-52160.

RemediationAI

Vendor-released patch: firmware WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin, available at https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin. Apply this firmware upgrade immediately on all WL-NU516U1 devices running the 708c073-mt7628 build. Until patching is complete, restrict access to the device management interface - particularly the Config Import functionality - by placing the device behind a firewall with no inbound management access from untrusted networks. Disabling remote management entirely eliminates the network attack surface for this vulnerability, though it prevents remote administration. The trade-off of disabling remote management is acceptable given the low administrative overhead of physically-local or VPN-gated management for this device class.