Wl Nu516U1 EUVD-2026-16146

Requires authenticated access to Wavlink WL-NU516U1 (firmware 260227) with login credentials. Attacker sends crafted HTTP request with malicious Content-Length header to /cgi-bin/nas.cgi endpoint triggering stack-based buffer overflow in ftext function.

This vulnerability presents a high real-world risk despite requiring low-level authentication (PR:L). The CVSS score of 8.8 reflects network accessibility (AV:N), low attack complexity (AC:L), and complete system compromise potential (C:H/I:H/A:H). Critically, a public proof-of-concept exploit is available on GitHub, dramatically lowering the barrier to exploitation and moving the CVSS Exploit Code Maturity to 'Proof-of-Concept' (E:P). The vendor's non-responsiveness (RL:X) means no official patch is available, leaving all deployed devices vulnerable indefinitely. While authentication is required, many IoT/NAS devices use default or weak credentials, making the PR:L requirement a low barrier. The combination of public exploit code, no vendor patch, network exposure, and the typical security posture of consumer NAS devices makes this a genuine priority for organizations using affected Wavlink products.

An attacker identifies a Wavlink WL-NU516U1 NAS device exposed to the internet or gains access to an internal network where the device resides. Using compromised low-privilege credentials (potentially obtained through credential stuffing with default passwords or phishing), the attacker sends a crafted HTTP request to /cgi-bin/nas.cgi with a maliciously oversized Content-Length header value that triggers the stack buffer overflow in the ftext function. By carefully crafting the overflow payload using the publicly available GitHub proof-of-concept, the attacker overwrites the return address on the stack to redirect execution to shellcode, gaining root-level access to the NAS device and all stored data, potentially pivoting to other network resources or exfiltrating sensitive files.