Skip to main content

Wavlink NU516U1 CVE-2026-8191

| EUVD-2026-28919 LOW
OS Command Injection (CWE-78)
2026-05-09 VulDB
Command Injection
2.1
CVSS 4.0

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Severity Changed
May 09, 2026 - 19:22 NVD
MEDIUM LOW
CVSS changed
May 09, 2026 - 19:22 NVD
6.3 (MEDIUM) 2.1 (LOW)
Analysis Generated
May 09, 2026 - 19:15 vuln.today
CVE Published
May 09, 2026 - 18:15 nvd
MEDIUM 6.3

DescriptionNVD

A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-bin/adm.cgi. Such manipulation of the argument skiplist1/skiplist2 leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

AnalysisAI

Remote OS command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated remote attackers to execute arbitrary system commands via the skiplist1/skiplist2 parameters in the wifi_region function of /cgi-bin/adm.cgi. The vulnerability is remotely exploitable with low complexity, affects confidentiality and integrity, and has publicly available exploit code.

Sign in for full analysis, threat intelligence, and remediation guidance.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

CVE-2026-8191 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy