Wavlink NU516U1 CVE-2026-8191

Authentication requirement is CRITICAL: the vulnerability requires PR:L (low privilege, user-level credentials) to the NU516U1 web administration interface. In practice, this means the attacker must possess valid admin or user credentials. Default credentials (if unchanged by the device owner) effectively remove this barrier. The skiplist1 and skiplist2 parameters are passed directly to the wifi_region function without input validation; any input containing shell metacharacters (pipes, semicolons, command substitution syntax) will be interpreted. No special device configuration is required beyond default web interface enablement (standard for device administration). Systems with strong, non-default credentials and network-restricted admin access significantly reduce real-world exploitation likelihood.

CVSS 6.3 with network vector and low complexity indicates moderate real-world risk. The authentication requirement (PR:L) and lack of scope change limit impact compared to unauthenticated RCE. However, E:P (Proof of Concept) rating combined with publicly available exploit code elevates practical risk - attackers with valid credentials can achieve arbitrary command execution. EPSS data not provided, but KEV status unknown suggests this may not yet be in active widespread exploitation despite public POC availability. The critical limiting factor is the authentication requirement: an attacker must first obtain valid device credentials. In typical IoT deployments, default credentials (admin/admin, etc.) are often present, effectively lowering the barrier. Risk assessment hinges on whether target systems use default or weak credentials.

An attacker with valid credentials (obtained via default password, credential stuffing, or phishing) accesses the NU516U1's web administration interface and crafts a request to /cgi-bin/adm.cgi with a malicious skiplist1 or skiplist2 parameter containing shell metacharacters (e.g., ; id # or $(whoami)). The unvalidated input is executed by the system, allowing the attacker to read device configuration, modify firewall rules, pivot to the local network, or disable security features.