What is the CVSS score of CVE-2026-2615?

CVE-2026-2615 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Wl Nu516u1 Firmware are affected by CVE-2026-2615?

A high-severity command injection vulnerability (CVE-2026-2615) affects Wl-Nu516U1 devices running firmware up to version 20251208, enabling attackers to execute arbitrary commands with no patch…

Is there a public PoC exploit available for CVE-2026-2615?

Yes, a public proof-of-concept exploit is available for CVE-2026-2615. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-2615?

Within 24 hours: Inventory all Wl-Nu516U1 devices in your environment, isolate affected systems from production networks where possible, and monitor for suspicious activity. Within 7 days: Implement network segmentation to restrict access to vulnerable devices, disable non-essential features/services on affected hardware, and deploy WAF/IDS rules to detect exploitation attempts. Within 30 days: Contact vendor for patched firmware status, evaluate device replacement or decommissioning, and conduct security assessment of any potentially compromised systems.

Wl Nu516u1 Firmware CVE-2026-2615

HIGH

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-02-17 cna@vuldb.com

Command Injection Wl Nu516u1 Firmware Wavlink

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 18, 2026 - 19:36 vuln.today

Public exploit code

CVE Published

Feb 17, 2026 - 13:16 nvd

HIGH 7.2

DescriptionCVE.org

A flaw has been found in Wavlink WL-NU516U1 up to 20251208. The affected element is the function singlePortForwardDelete of the file /cgi-bin/firewall.cgi. Executing a manipulation of the argument del_flag can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Wl-Nu516U1 Firmware versions up to 20251208. contains a vulnerability that allows attackers to command injection (CVSS 7.2).

Technical ContextAI

affects Wl-Nu516U1 Firmware. has been found in Wavlink WL-NU516U1 up to 20251208. The affected element is the function singlePortForwardDelete of the file /cgi-bin/firewall.cgi. Executing a manipulation of the argument del_flag can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.