Is there a public PoC exploit available for CVE-2026-8189?

Yes, a public proof-of-concept exploit is available for CVE-2026-8189. Prioritise patching immediately. EPSS: 0.8%.

Wavlink NU516U1 CVE-2026-8189

Q: What is the CVSS score of CVE-2026-8189?

CVE-2026-8189 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-28916 LOW

OS Command Injection (CWE-78)

2026-05-09 VulDB

GHSA-2hvf-6vwf-3fjq

Command Injection Nu516U1

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 09, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

May 09, 2026 - 17:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 09, 2026 - 17:00 vuln.today

CVE Published

May 09, 2026 - 16:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was found in Wavlink NU516U1 M16U1_V240425. Affected by this vulnerability is the function wzdrepeater of the file /cgi-bin/adm.cgi. The manipulation of the argument wlan_bssid/sel_Automode/sel_EncrypTyp results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

AnalysisAI

Remote authenticated command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated attackers to execute arbitrary OS commands via manipulation of wlan_bssid, sel_Automode, or sel_EncrypTyp parameters in the wzdrepeater function at /cgi-bin/adm.cgi. CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P) with public exploit code available; vendor was notified early of this disclosure.

Technical ContextAI

The vulnerability exists in the wzdrepeater function of the administrative CGI interface (/cgi-bin/adm.cgi) on the Wavlink NU516U1 WiFi repeater. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating that user-supplied input from the wlan_bssid, sel_Automode, or sel_EncrypTyp parameters is passed unsafely to OS command execution functions without adequate input validation or sanitization. The Wavlink NU516U1 is a mesh WiFi repeater device, and the /cgi-bin/adm.cgi endpoint handles administrative configuration tasks, making it a high-value attack surface for an authenticated attacker already on the network or with valid credentials.

RemediationAI

Primary remediation: Contact Wavlink support to obtain and install a patched firmware version for the NU516U1 (version not specified in available references - vendor advisory URL not provided). If a patched firmware is not available, implement the following compensating controls: (1) Restrict network access to the /cgi-bin/adm.cgi endpoint using firewall rules, permitting administration only from trusted management subnets or VPN; (2) Change default administrative credentials to a strong, randomly-generated password and disable any guest or shared account access to the web UI; (3) Isolate the repeater device on a separate network segment with minimal trust relationships to critical systems; (4) Monitor for suspicious command patterns in web server logs (e.g., shell metacharacters like |, ;, $, or backticks in CGI parameters). If the device must remain operational pending a patch, the firewall segmentation provides the strongest mitigation but limits remote management capability.