Is there a public PoC exploit available for CVE-2026-8191?

Yes, a public proof-of-concept exploit is available for CVE-2026-8191. Prioritise patching immediately. EPSS: 0.8%.

Wavlink NU516U1 CVE-2026-8191

Q: What is the CVSS score of CVE-2026-8191?

CVE-2026-8191 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-28919 LOW

OS Command Injection (CWE-78)

2026-05-09 VulDB

Command Injection Nu516U1

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 09, 2026 - 19:22 NVD

MEDIUM LOW

CVSS changed

May 09, 2026 - 19:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 09, 2026 - 19:15 vuln.today

CVE Published

May 09, 2026 - 18:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-bin/adm.cgi. Such manipulation of the argument skiplist1/skiplist2 leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

AnalysisAI

Remote OS command injection in Wavlink NU516U1 M16U1_V240425 allows authenticated remote attackers to execute arbitrary system commands via the skiplist1/skiplist2 parameters in the wifi_region function of /cgi-bin/adm.cgi. The vulnerability is remotely exploitable with low complexity, affects confidentiality and integrity, and has publicly available exploit code.

Technical ContextAI

The vulnerability exists in a CGI-based web administration interface (adm.cgi) commonly found in embedded network devices. The wifi_region function fails to properly validate user-supplied input in the skiplist1 and skiplist2 parameters before passing them to OS command execution contexts, violating CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The attack leverages the CGI script's direct shell interaction without adequate input sanitization, a common pattern in legacy embedded device firmware.

RemediationAI

Vendor contact was established early; check Wavlink security advisories for patched firmware release. If a patched version is available, upgrade immediately to the latest NU516U1 firmware. Until patching: (1) Change default administrative credentials to strong, unique passwords - this is the primary practical control since authentication is required; (2) Restrict network access to the device's web administration interface (port 80/443 typically) using firewall rules, limiting access to trusted administrative networks only; (3) Disable remote administration if locally managing the device is feasible - check device settings for 'Remote Management' or similar toggles. Apply these mitigations in order of practicality; firewall restriction has minimal performance impact, while disabling remote admin may reduce operational convenience.