EUVD-2026-52189
GHSA-jfmw-hm93-c7jh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-facing CGI endpoint requires no privileges or interaction; full system impact without scope change to external systems.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
AnalysisAI
Stack-based buffer overflow in the Wavlink WL-NU516U1 NAS device's nas.cgi password change handler allows remote unauthenticated attackers to potentially execute arbitrary code by supplying an oversized User1Passwd argument to the change_password function. Affecting the MT7628 firmware variant (708c073-mt7628), this carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact and no privileges or user interaction required. A public proof-of-concept has been published and a vendor-released firmware patch is available as of 2026-07-13; no confirmed CISA KEV listing at time of analysis.
Technical ContextAI
The Wavlink WL-NU516U1 is a consumer/SMB NAS device built on the MediaTek MT7628 SoC, a commonly used chipset in budget networking hardware. Its web management interface relies on CGI scripts - specifically nas.cgi - to handle user actions. The change_password function within nas.cgi processes the User1Passwd HTTP parameter without adequate bounds checking before copying it into a fixed-size stack buffer, satisfying CWE-121 (Stack-Based Buffer Overflow). An oversized input can overwrite adjacent stack memory including the saved return address, enabling control-flow hijacking. The CPE cpe:2.3:a:wavlink:wl-nu516u1:*:*:*:*:*:*:*:* with a wildcard version indicates all firmware revisions prior to the vendor patch are considered affected.
RemediationAI
Apply the vendor-released firmware update immediately - the patched sysupgrade image (commit 4b8a21f, dated 2026-07-13) is available at https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin. Until the firmware update is applied, restrict network access to the device's web management interface: block inbound connections to HTTP/HTTPS ports (typically 80 and 443) at the perimeter firewall or router, ensuring the nas.cgi endpoint is not reachable from untrusted networks or the WAN. This compensating control does not fix the underlying buffer overflow but eliminates remote exploitability by making the vulnerable endpoint unreachable. Note that devices accessible only on isolated internal segments face lower - but not zero - risk, as the attack can also originate from a compromised internal host.
More in Wl Nu516U1
View allRemote attackers can exploit a stack-based buffer overflow in the /cgi-bin/nas.cgi endpoint of Wavlink WL-NU516U1 by man
Stack-based buffer overflow in the Wavlink WL-NU516U1 (firmware 708c073-mt7628) router's nas.cgi handler lets remote una
OS command injection in the Wavlink WL-NU516U1 firmware (build 708c073-mt7628) allows remote attackers to execute arbitr
OS command injection in the Wavlink WL-NU516U1 router's CGI web administration interface allows authenticated network at
A vulnerability was found in Wavlink WL-NU516U1 240425.
OS command injection in the Wavlink WL-NU516U1 router's admin password handler allows a remote, low-privileged authentic
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today