Wavlink NU516U1 EUVD-2026-28918

Exploitation requires authenticated access to the administrative interface (PR:L in CVSS indicates low privileges - likely a valid user or guest account). The vulnerability is triggered when the attacker supplies specially crafted values to any of the five vulnerable parameters: ppp_username, ppp_passwd, rwan_ip, rwan_mask, or rwan_gateway in a request to the /cgi-bin/adm.cgi wan function. No special network configuration or non-default feature enablement is implied by the CVE description - the wan function appears to be part of standard WAN configuration. The attack does NOT require user interaction, unauthenticated access, or scope escalation (S:U). Limitation: exploitation is constrained by the requirement for valid credentials; devices with changed default credentials or restricted administrative access are at lower risk. The integrity and availability impacts are rated as Low, suggesting either that command execution is sandboxed or that injected commands are constrained in what system state they can modify.

CVSS 6.3 with network attack vector and low complexity indicates moderate severity, but real-world risk is elevated by several factors. The vulnerability requires authentication (PR:L), which constrains exploitation to users with valid network access or compromised credentials - typical in scenarios where routers are accessible via internal networks or weak default credentials. The E:P (Exploit: Proof of Concept) and R:R (Reliability: Reasonable) rating in the CVSS vector, combined with public exploit code availability, increases practical exploitation likelihood. However, the CVSS confidentiality, integrity, and availability impacts are all rated as 'Low' rather than 'High,' suggesting the command injection may be constrained in scope (e.g., commands may execute with limited privileges). No KEV status or EPSS score provided, so true-world exploitation frequency is uncertain; this could indicate either targeted exploitation in specific networks or genuine low real-world impact despite public POC availability. The lack of active CISA KEV listing suggests this is not yet a widespread, industrialized attack vector, but the public disclosure and available exploit code mean opportunistic exploitation by network-local attackers or threat actors with internal access is realistic. Defenders should prioritize patching if the router is internet-facing or accessible from untrusted networks; lower priority if deployed in air-gapped or highly controlled environments.

An attacker with valid credentials to the Wavlink NU516U1 administrative interface (obtained via default credentials, credential stuffing, or phishing) navigates to or sends a crafted HTTP POST request to /cgi-bin/adm.cgi with the wan function, embedding shell commands in the ppp_username parameter such as 'user; cat /etc/passwd' or similar syntax. The application concatenates this unsanitized input into a system call, causing the injected command to execute on the device with the privileges of the web server process.