Wavlink NU516U1 EUVD-2026-28916

Exploitation requires authenticated access to the Wavlink NU516U1 web administration interface. The attacker must possess valid credentials (username and password) to reach the /cgi-bin/adm.cgi endpoint and interact with the wzdrepeater function. Once authenticated, no further user interaction is required to trigger the injection (UI:N per CVSS vector), and the attack succeeds against default configurations. The vulnerability is limited to the administrative CGI interface, so the attacker must have network-layer access to the device's HTTP service (typically TCP/80 or TCP/443). Network segmentation, firewall rules, or administrative authentication mechanisms act as primary controls; devices exposed directly to the internet with default or weak credentials are at highest risk. Non-default firewall policies blocking HTTP/HTTPS access to the admin interface eliminate attack surface entirely.

The CVSS score of 6.3 reflects moderate impact with network accessibility but limited scope and authentication requirement (PR:L). The attack vector is network-based with low complexity, but exploitation requires valid login credentials (PR:L), which significantly reduces the real-world risk compared to unauthenticated RCE. However, multiple risk signals elevate concern: CVSS evidence=P (Proof of Concept) and reliability=R (Reasonable) confirm public exploit availability; the CPE indicates the specific vulnerable firmware version M16U1_V240425 is in the wild; and VulDB reporting confirms active tracking. The low CVSS relative to command injection severity suggests the PR:L (authenticated) requirement is the primary limiting factor. No KEV status was provided, so active exploitation beyond POC cannot be confirmed. For organizations using this device, authenticated command injection is a critical risk because repeater administration is often accessible to guest users or via weak default credentials. The real-world priority depends on credential exposure risk in the target environment.

An attacker with valid credentials to the Wavlink NU516U1 web administration interface (obtained via credential stuffing, weak default password, or social engineering targeting the device owner) navigates to the wzdrepeater configuration section and injects shell metacharacters (e.g., ; or |) into the wlan_bssid, sel_Automode, or sel_EncrypTyp parameter fields, causing the backend CGI script to execute arbitrary OS commands with the privilege level of the web server process (typically root on embedded Linux devices). The publicly available POC demonstrates the exact injection payload syntax.