Which versions of Wavlink WL-NU516U1 are affected by CVE-2026-18588?

The Wavlink WL-NU516U1 router contains a critical remote code execution vulnerability (CVE-2026-18588, CVSS 9.3) enabling unauthenticated network attackers to fully compromise affected devices.. A patch is available.

How to fix or mitigate CVE-2026-18588?

Within 24 hours, inventory all Wavlink WL-NU516U1 routers in the environment and identify those with internet exposure or in critical network positions. Within 7 days, obtain the patched firmware version from Wavlink's security advisory and develop a staged deployment plan prioritizing externally-facing and critical devices. Within 30 days, deploy the vendor-released patch to all affected devices, confirm successful firmware updates, and review access logs for exploitation attempts.

Wavlink WL-NU516U1 CVE-2026-18588

Q: What is the CVSS score of CVE-2026-18588?

CVE-2026-18588 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

EUVD-2026-52167 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-08-03 VulDB

GHSA-hfj9-7vrj-jwv3

Buffer Overflow Stack Overflow Wl Nu516U1 Wavlink

9.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network request to nas.cgi (AV:N/AC:L/PR:N/UI:N); stack overflow enabling code execution on the device yields full C/I/A impact with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 07:22 vuln.today

CVE Published

Aug 03, 2026 - 06:00 cve.org

CRITICAL 9.3

DescriptionCVE.org

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT_LENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

Stack-based buffer overflow in the Wavlink WL-NU516U1 (firmware 708c073-mt7628) router's nas.cgi handler lets remote unauthenticated attackers overflow a fixed-size stack buffer by manipulating the HTTP CONTENT_LENGTH value processed via fgets. Successful exploitation can crash the device or execute arbitrary code with full compromise of confidentiality, integrity, and availability. A public write-up (GitHub report2.md) exists, but the flaw is not listed in CISA KEV - no public weaponized exploit is confirmed at time of analysis.

Technical ContextAI

The affected component is nas.cgi, a CGI binary that provides NAS/USB-storage management on the Wavlink WL-NU516U1, a MediaTek MT7628-based SOHO wireless router/USB adapter running an embedded Linux (MIPS) firmware. The vulnerability is CWE-121 (stack-based buffer overflow): the code reads the attacker-controlled CONTENT_LENGTH CGI/environment value into a fixed-size stack buffer via fgets without adequate bounds enforcement, so an oversized value corrupts the stack frame, saved registers, and return address. On MIPS embedded targets lacking modern exploit mitigations (often no ASLR/NX or weak protections), such overflows are frequently escalated from denial of service to remote code execution.

RemediationAI

Patch available per vendor advisory - the vendor was contacted early and released a fixed firmware image, available at https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin; apply this sysupgrade firmware (build 4b8a21f-mt7628, dated 2026-07-13) as the primary fix. Until updating, reduce exposure by ensuring the router's web/NAS management interface is not reachable from the WAN (disable remote/WAN administration), and restrict access to the LAN-side management interface to trusted hosts only. If the NAS/USB feature is unused, disable it to remove the nas.cgi attack surface; the trade-off is loss of network storage functionality. Note that blocking or filtering management ports on the LAN may disrupt legitimate administration, so validate connectivity after applying controls.