Is there a patch available for CVE-2026-18590?

Yes, a patch is available for CVE-2026-18590. Update the affected software to the latest version immediately.

Wavlink WL-NU516U1 CVE-2026-18590

Q: What is the CVSS score of CVE-2026-18590?

CVE-2026-18590 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.1%.

EUVD-2026-52223 LOW

OS Command Injection (CWE-78)

2026-08-03 VulDB

GHSA-29gr-cg9c-hpx3

Command Injection Wl Nu516U1 Wavlink

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

OS command injection on embedded router yields full device control; PR:L reflects required low-privilege authentication; scope unchanged as impact is confined to the router itself.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 03, 2026 - 08:37 NVD

MEDIUM LOW

CVSS changed

Aug 03, 2026 - 08:37 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 03, 2026 - 08:27 vuln.today

DescriptionCVE.org

A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

OS command injection in the Wavlink WL-NU516U1 router's admin password handler allows a remote, low-privileged authenticated attacker to execute arbitrary operating system commands via the set_sys_adm function in adm.cgi. The affected firmware version is 708c073-mt7628, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the vendor has responded promptly and released a patched firmware dated 2026-07-13.

Technical ContextAI

The vulnerability resides in the CGI-based web administration interface of the Wavlink WL-NU516U1 router, which runs on a MediaTek MT7628 chipset (identified in the firmware naming convention 'mt7628'). The affected component is adm.cgi, specifically the set_sys_adm function responsible for handling admin password changes. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) describes the root cause: user-supplied input is passed to a system shell call without adequate sanitization or escaping, allowing injection of arbitrary shell metacharacters. The CPE cpe:2.3:a:wavlink:wl-nu516u1:*:*:*:*:*:*:*:* covers all versions of the product prior to the patch. This class of vulnerability in embedded router CGI handlers is well-understood and frequently exploitable in practice.

RemediationAI

Apply the vendor-released patched firmware WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin, available directly at https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin. Prior to patching, restrict access to the router's web administration interface to trusted management networks or hosts only - exposing adm.cgi to untrusted LAN segments or the internet directly enables exploitation. Disabling remote web administration if not operationally required is an effective compensating control with minimal trade-off for most home and small-office deployments. Changing default admin credentials reduces the impact of the PR:L requirement by preventing low-effort credential stuffing, though it does not eliminate the vulnerability. Reference the VulDB advisory at https://vuldb.com/vuln/385418 for further vendor guidance.