Is there a public PoC exploit available for CVE-2026-8227?

Yes, a public proof-of-concept exploit is available for CVE-2026-8227. Prioritise patching immediately. EPSS: 0.8%.

Wavlink NU516U1 CVE-2026-8227

Q: What is the CVSS score of CVE-2026-8227?

CVE-2026-8227 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-28975 LOW

OS Command Injection (CWE-78)

2026-05-10 VulDB

GHSA-6xrj-qcqh-6mmx

Command Injection Nu516U1

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 10, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

May 10, 2026 - 05:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 10, 2026 - 05:15 vuln.today

CVE Published

May 10, 2026 - 03:45 nvd

MEDIUM 6.3

DescriptionCVE.org

A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

AnalysisAI

Remote OS command injection in Wavlink NU516U1 240425 via the wzdapMesh function in /cgi-bin/adm.cgi allows authenticated remote attackers to execute arbitrary operating system commands with limited system impact. Publicly available exploit code exists, and the vendor has been notified of the disclosure.

Technical ContextAI

The vulnerability exists in the CGI script handler (/cgi-bin/adm.cgi) of the Wavlink NU516U1 mesh networking device. The wzdapMesh function fails to properly sanitize user-supplied input before passing it to OS command execution functions, falling under CWE-78 (OS Command Injection). This is a classic improper input validation flaw in web-based device management interfaces where user-controlled parameters are concatenated into shell commands without escaping or parameterization. The affected product is a mesh networking device running firmware version 240425, identified by CPE cpe:2.3:a:wavlink:nu516u1.

RemediationAI

Contact Wavlink for patched firmware release addressing the input validation flaw in the wzdapMesh function. Immediate mitigation: restrict network access to the device management interface (/cgi-bin/adm.cgi) to trusted administrative networks only, using network segmentation, firewall rules, or VPN access controls. Disable remote management of the mesh network feature if not actively used. Change default or shared credentials used to access the device web interface to reduce likelihood of unauthorized authenticated access. Monitor access logs for suspicious requests to /cgi-bin/adm.cgi with wzdapMesh parameters. Do NOT expose the device management interface directly to the internet; require VPN or bastion host access.