Wavlink WL-NU516U1 CVE-2026-18590

Exploitation requires authenticated access with at least low-privileged credentials to the router's web administration interface (PR:L per CVSS 4.0). The attacker must be able to reach the admin interface over the network (AV:N), which in typical home/SMB deployments means LAN access unless remote management is explicitly enabled. The vulnerable code path is triggered through the Admin Password Handler (set_sys_adm in adm.cgi), meaning the admin panel must be accessible and functional. No user interaction is required beyond the attacker's own authenticated session (UI:N). Exploitation is limited by the need for valid credentials - unauthenticated remote exploitation is not indicated by the available data. If the admin interface is not exposed to the WAN, internet-based attackers must first gain LAN access.

The CVSS 4.0 score of 5.3 (Medium) with impact metrics VC:L/VI:L/VA:L appears notably conservative for an OS command injection flaw - this scoring may reflect VulDB's judgment about the constrained environment of the router's OS rather than the actual attacker capability gained. An independent assessment placing C:H/I:H/A:H is more consistent with the nature of arbitrary OS command execution on embedded Linux firmware, which typically yields full device control. The E:P exploitability flag confirms a public proof-of-concept exists, elevating practical risk above the raw score. No EPSS data was provided and no CISA KEV listing is present, suggesting exploitation is not currently widespread. Attack complexity is low (AC:L/AT:N) and no user interaction is required, but the PR:L requirement limits unauthenticated mass exploitation. The discrepancy between the CVSS 4.0 impact metrics and the severity of OS command injection should be noted - defenders should not underweight this based on the 5.3 score alone.

An attacker who has obtained low-privileged credentials to the Wavlink WL-NU516U1 admin interface - through credential stuffing, default credentials, or prior compromise - sends a crafted HTTP POST request to adm.cgi targeting the set_sys_adm function with shell metacharacters embedded in the password parameter. The router's CGI handler passes the unsanitized input to an OS shell call, executing the attacker's injected commands as the process owner on the router's embedded Linux OS. A public proof-of-concept is available on GitHub, lowering the bar for exploitation significantly.