Wavlink NU516U1 CVE-2026-8188

Authentication as a valid user account (PR:L per CVSS vector) is required - the attacker must have valid credentials to access the /cgi-bin/adm.cgi endpoint and invoke the change_wifi_password function. No special device configuration or non-default settings are explicitly mentioned; the vulnerability appears to be present in standard deployments. The vulnerability exists in the M16U1_V240425 firmware version; exploitation against other firmware versions is not independently confirmed in the CVE data but is plausible given the wildcard CPE. The attack vector is network-based with no user interaction required (UI:N), meaning an authenticated attacker can submit a crafted HTTP POST/GET request directly without social engineering. Limiting factors: unauthenticated attackers cannot exploit this vulnerability - they must first obtain valid credentials through credential compromise, default credential use, or phishing. Devices with strong, changed administrative credentials and restricted network access to the management interface are at lower risk.

CVSS 6.3 with AV:N/AC:L reflects remote network accessibility and low attack complexity, but the CVSS vector includes PR:L (low privilege requirement), meaning authentication is mandatory - this significantly reduces real-world risk compared to unauthenticated exploits. The E:P designation indicates publicly available exploit code, confirming feasibility. The vulnerability is not listed as actively exploited in CISA KEV at time of analysis, suggesting opportunistic rather than widespread weaponization. However, the combination of remote exploitability, authentication-as-the-only-barrier, and public POC means compromised low-privilege accounts (e.g., guest WiFi admin credentials, default credentials) could lead to device compromise and lateral network movement. The RL:X (remediation level unknown) and RC:R (reasonable confidence in CVE details) suggest the vendor response status is unclear. Real risk depends heavily on deployment: devices exposed to untrusted networks or using weak/default credentials face higher practical risk than those in isolated corporate networks with strong access controls.

An attacker with valid low-privilege credentials (obtained via phishing, credential compromise, or default credentials if unchanged) logs into the Wavlink NU516U1's web interface or directly crafts an HTTP request to /cgi-bin/adm.cgi with the change_wifi_password function. The attacker injects shell metacharacters (e.g., backticks, pipes, semicolons) into the wl_Pass parameter, such as ; cat /etc/passwd #, causing the device to execute arbitrary commands with the privileges of the CGI process. The attacker gains remote command execution on the device, potentially pivoting to the local network, exfiltrating configuration data, or disrupting network connectivity.