EUVD-2026-52189
GHSA-jfmw-hm93-c7jh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify Wavlink WL-NU516U1 web interface
-
DeliverySend crafted HTTP POST to nas.cgi
-
ExploitSupply oversized User1Passwd argument
-
InstallOverflow stack buffer in change_password()
-
C2Overwrite saved return address
-
ExecuteRedirect execution to attacker payload
-
ImpactAchieve arbitrary code execution
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The nas.cgi script must be reachable via HTTP or HTTPS on the device's web management port (typically 80 or 443). No authentication is required - the CVSS 4.0 vector specifies PR:N and UI:N, indicating the vulnerable password change endpoint is accessible without a valid session. Exploitation is constrained to network-reachable instances: devices where the web interface is firewalled from untrusted networks or where WAN-side remote management is disabled have significantly reduced exposure. The vulnerability is specific to the MT7628 firmware variant (708c073-mt7628); other Wavlink hardware variants running different firmware branches are not confirmed affected by available data. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H reflects the most severe combination of exploitability factors: remote, low-complexity, unauthenticated, and no user interaction required. The E:P modifier in the CVSS 4.0 supplemental data confirms a public proof-of-concept exists, meaningfully lowering the bar for opportunistic attackers. This is not currently listed in the CISA KEV catalog, and EPSS data was not included in the input - however, the presence of a public PoC on GitHub combined with a zero-privilege network-exploitable overflow in a consumer NAS warrants urgent patching rather than deferral. The vendor responded quickly and released a patch, which narrows the window of exposure. Real-world exploitation risk is moderated by the product's niche market footprint and the assumption that many deployments do not expose the web interface to the WAN. |
| Exploit ScenarioDerived | An unauthenticated attacker on the network sends a crafted HTTP POST request to the nas.cgi password change endpoint with an excessively long User1Passwd parameter value. The oversized input overflows the fixed-size stack buffer in the change_password function, overwriting the saved return address with attacker-controlled data. Upon function return, execution redirects to shellcode or a ROP chain, potentially granting the attacker full code execution with the privileges of the web server process on the device. A public proof-of-concept detailing this technique is available at https://github.com/oduoke567/WAVLINK-NU516U1-2026-05-1/blob/main/report2.md. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 03, 2026
Stack-based buffer overflow in the Wavlink WL-NU516U1 NAS device's nas.cgi password change handler allows remote unauthenticated attackers to potentially execute arbitrary code by supplying an oversized User1Passwd argument to the change_password function. Affecting the MT7628 firmware variant (708c073-mt7628), this carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact and no privileges or user interaction required. A public proof-of-concept has been published and a vendor-released firmware patch is available as of 2026-07-13; no confirmed CISA KEV listing at time of analysis.
Earlier versions of this analysis (1)
Stack-based buffer overflow in the Wavlink WL-NU516U1 (firmware build 708c073-mt7628) NAS management interface allows remote attackers to corrupt the stack via an oversized User1Passwd argument passed to the change_password function in nas.cgi. The overflow can lead to denial of service or arbitrary code execution on the router's MIPS/MediaTek MT7628 platform. Publicly available exploit code exists (VulDB, GitHub report), and the vendor has already shipped a fixed firmware image; there is no public evidence of active in-the-wild exploitation.
RemediationAI
Apply the vendor-released firmware update immediately - the patched sysupgrade image (commit 4b8a21f, dated 2026-07-13) is available at https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin. Until the firmware update is applied, restrict network access to the device's web management interface: block inbound connections to HTTP/HTTPS ports (typically 80 and 443) at the perimeter firewall or router, ensuring the nas.cgi endpoint is not reachable from untrusted networks or the WAN. This compensating control does not fix the underlying buffer overflow but eliminates remote exploitability by making the vulnerable endpoint unreachable. Note that devices accessible only on isolated internal segments face lower - but not zero - risk, as the attack can also originate from a compromised internal host.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Wavlink WL-NU516U1 is a consumer/SMB NAS device built on the MediaTek MT7628 SoC, a commonly used chipset in budget networking hardware. Its web management interface relies on CGI scripts - specifically nas.cgi - to handle user actions. The change_password function within nas.cgi processes the User1Passwd HTTP parameter without adequate bounds checking before copying it into a fixed-size stack buffer, satisfying CWE-121 (Stack-Based Buffer Overflow). An oversized input can overwrite adjacent stack memory including the saved return address, enabling control-flow hijacking. The CPE cpe:2.3:a:wavlink:wl-nu516u1:*:*:*:*:*:*:*:* with a wildcard version indicates all firmware revisions prior to the vendor patch are considered affected.
Know when Wl Nu516U1 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Network-facing CGI endpoint requires no privileges or interaction; full system impact without scope change to external systems.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Executive ViewAI
The Wavlink WL-NU516U1 NAS device contains a vulnerability enabling external attackers to compromise systems without credentials or user interaction. Attackers can steal, delete, or modify stored data and disrupt availability, directly threatening data confidentiality and organizational operations. Publicly available exploitation code accelerates risk materialization, requiring immediate action across affected hardware.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Wl Nu516U1
View allRemote attackers can exploit a stack-based buffer overflow in the /cgi-bin/nas.cgi endpoint of Wavlink WL-NU516U1 by man
Stack-based buffer overflow in the Wavlink WL-NU516U1 (firmware 708c073-mt7628) router's nas.cgi handler lets remote una
OS command injection in the Wavlink WL-NU516U1 firmware (build 708c073-mt7628) allows remote attackers to execute arbitr
OS command injection in the Wavlink WL-NU516U1 router's CGI web administration interface allows authenticated network at
A vulnerability was found in Wavlink WL-NU516U1 240425.
OS command injection in the Wavlink WL-NU516U1 router's admin password handler allows a remote, low-privileged authentic
Exploit-DB