EUVD-2026-12208Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was found in Wavlink WL-NU516U1 240425. The impacted element is the function sub_404F68 of the file /cgi-bin/login.cgi. The manipulation of the argument homepage/hostname results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
AnalysisAI
A vulnerability was found in Wavlink WL-NU516U1 240425.
Technical ContextAI
Cross-site scripting (XSS) allows injection of client-side scripts into web pages viewed by other users due to insufficient output encoding.
RemediationAI
Encode all user-supplied output contextually (HTML, JS, URL). Implement Content Security Policy (CSP) headers. Use HTTPOnly and Secure cookie flags.
More in Wl Nu516U1
View allRemote attackers can exploit a stack-based buffer overflow in the /cgi-bin/nas.cgi endpoint of Wavlink WL-NU516U1 by man
Stack-based buffer overflow in the Wavlink WL-NU516U1 (firmware 708c073-mt7628) router's nas.cgi handler lets remote una
Stack-based buffer overflow in the Wavlink WL-NU516U1 NAS device's nas.cgi password change handler allows remote unauthe
OS command injection in the Wavlink WL-NU516U1 firmware (build 708c073-mt7628) allows remote attackers to execute arbitr
OS command injection in the Wavlink WL-NU516U1 router's CGI web administration interface allows authenticated network at
OS command injection in the Wavlink WL-NU516U1 router's admin password handler allows a remote, low-privileged authentic
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today