Wavlink NU516U1 CVE-2026-8230

Authentication is required: the attacker must possess valid login credentials for the device's web management interface (PR:L per CVSS vector). The vulnerability is triggered via the ipaddr parameter in the sys_login1 function during the login/authentication process in /cgi-bin/login.cgi. No special device configuration or firmware build option is mentioned; the flaw appears to exist in the standard login flow. Attack vector is network-based with no user interaction required. Exploitation is limited to the security context of the CGI process and the network isolation of the device itself; the scope is unaffected (S:U), meaning no escape to other systems on the network is inherent to the vulnerability.

The CVSS 6.3 (Medium) score reflects a balanced threat profile: network-accessible vector (AV:N) and low attack complexity (AC:L) are favorable for attackers, but the requirement for prior authentication (PR:L) significantly limits exposure. The E:P flag (Exploit Proof-of-Concept available) and public POC code on GitHub confirm practical exploitability. However, the limited scope (S:U) and impact (C:L/I:L/A:L-not complete system compromise) mean successful exploitation grants bounded access. Real-world risk depends on whether the device is internet-facing and whether valid credentials can be obtained (default credentials, credential reuse, or prior compromise). No KEV or CISA listing is present, and no EPSS score was provided; this suggests limited evidence of active exploitation in the wild despite public POC availability. For internal/enterprise networks with weak credential hygiene, this poses moderate risk; for internet-facing routers with default credentials, it is considerably higher.

An authenticated attacker with valid credentials (obtained via default credentials, phishing, or credential reuse) connects to the device's web management interface and submits a specially crafted login request with OS command metacharacters (e.g., semicolons, pipes) embedded in the ipaddr parameter. The sys_login1 function passes this input unsanitized to a system command, allowing execution of arbitrary commands such as creating backdoor accounts, exfiltrating configuration files, or modifying firewall rules. The attacker gains the privileges of the CGI process (likely root or a service account on embedded Linux).