Is there a public PoC exploit available for CVE-2026-8229?

Yes, a public proof-of-concept exploit is available for CVE-2026-8229. Prioritise patching immediately. EPSS: 0.8%.

Wavlink NU516U1 CVE-2026-8229

Q: What is the CVSS score of CVE-2026-8229?

CVE-2026-8229 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-28977 LOW

OS Command Injection (CWE-78)

2026-05-10 VulDB

GHSA-c696-6wrh-863m

Command Injection Nu516U1

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 10, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

May 10, 2026 - 05:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 10, 2026 - 05:15 vuln.today

CVE Published

May 10, 2026 - 04:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument AuthMethod/EncrypType results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

AnalysisAI

Remote command injection in Wavlink NU516U1 240425 allows authenticated attackers to execute arbitrary OS commands via manipulation of the AuthMethod or EncrypType arguments in the WifiBasic function of /cgi-bin/wireless.cgi. Publicly available exploit code exists, and the vendor was notified early of the disclosure.

Technical ContextAI

The vulnerability resides in the wireless configuration CGI handler at /cgi-bin/wireless.cgi, specifically within the WifiBasic function which processes WiFi authentication parameters. The affected parameters (AuthMethod and EncrypType) are insufficiently sanitized before being passed to OS command execution, creating a classic command injection vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command). The device appears to be a wireless router/access point where web-based management interfaces are common attack surfaces. The vulnerability requires network access to the administrative interface and authenticated credentials, limiting exposure to authorized users or those who can bypass authentication.

RemediationAI

Contact Wavlink support for availability of patched firmware beyond version 240425, as no vendor-released patch version is currently confirmed. Immediate compensating controls: (1) restrict network access to the administrative interface at /cgi-bin/wireless.cgi to trusted networks only using firewall rules or VPN; (2) change default administrative credentials to strong, unique passwords and enforce account lockout policies; (3) disable remote management features if not required; (4) consider isolating the device on a separate management network segment with restricted inter-VLAN routing. If the device supports firmware updates, check the Wavlink support portal regularly. Users should avoid exposing the management interface directly to the internet or untrusted networks until patched firmware is available.