What is the CVSS score of CVE-2026-3613?

CVE-2026-3613 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wl Nu516u1 Firmware are affected by CVE-2026-3613?

A HIGH severity vulnerability (CVE-2026-3613) in Wavlink WL-NU516U1 wireless access points allows unauthenticated attackers to exploit the login function, potentially compromising network access…

Is there a public PoC exploit available for CVE-2026-3613?

Yes, a public proof-of-concept exploit is available for CVE-2026-3613. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-3613?

Within 24 hours: Inventory all Wavlink WL-NU516U1 V240425 devices in production; isolate or disable internet-facing instances; implement network access controls limiting login.cgi access to trusted administrative subnets only. Within 7 days: Deploy WAF rules blocking suspicious requests to /cgi-bin/login.cgi; consider firmware downgrade if earlier versions are unaffected; engage Wavlink support for patch ETA. Within 30 days: Replace affected devices with alternative vendors or deploy replacement firmware if available; conduct access logs review for exploitation evidence.

Wl Nu516u1 Firmware CVE-2026-3613

HIGH

Buffer Overflow (CWE-119)

2026-03-06 cna@vuldb.com

Buffer Overflow Stack Overflow Wl Nu516u1 Firmware

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

PoC Detected

Mar 10, 2026 - 18:30 vuln.today

Public exploit code

CVE Published

Mar 06, 2026 - 02:15 nvd

HIGH 7.2

DescriptionCVE.org

A vulnerability was identified in Wavlink WL-NU516U1 V240425. This vulnerability affects the function sub_401A0C of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

AnalysisAI

Stack-based buffer overflow in Wavlink WL-NU516U1 firmware's login.cgi allows remote attackers with high privileges to achieve complete system compromise through a malformed ipaddr parameter. Public exploit code exists for this vulnerability, and no patch is currently available. The flaw enables unauthenticated remote code execution with full read, write, and execution capabilities on affected devices.

Technical ContextAI

Classified as CWE-119 (Buffer Overflow). Affects Wl-Nu516U1 Firmware. A vulnerability was identified in Wavlink WL-NU516U1 V240425. This vulnerability affects the function sub_401A0C of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

RemediationAI

Monitor vendor advisories for a patch. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.