Wavlink NU516U1 EUVD-2026-28920

Exploitation requires authentication to the Wavlink NU516U1 web management interface (PR:L in CVSS vector), meaning the attacker must possess valid HTTP credentials or hijack an authenticated session. The vulnerable function wzdap in /cgi-bin/adm.cgi must be accessible via HTTP/HTTPS on the management port (typically TCP 80 or 443), and the device must be reachable from the attacker's network. No special firmware configuration is implied as a prerequisite-the flaw is present in the default adm.cgi script. The limiting factor is the authentication requirement (PR:L); unauthenticated remote exploitation is not possible without first obtaining valid credentials or exploiting a separate authentication bypass vulnerability. Default credentials (common in Wavlink devices) or brute-force attacks may satisfy this requirement. Network reachability to the management interface (typically not exposed to WAN in secure deployments) is also a practical limiting factor.

CVSS 6.3 with authenticated access (PR:L) moderates the baseline severity, but several factors elevate practical risk: the publicly available exploit code (POC confirmed), E:P vector indicating proof-of-concept or functional exploit maturity, and the remote network attack vector (AV:N/AC:L) make this readily weaponizable. However, exploitation requires prior authentication to the web interface (PR:L), which suggests the attacker must first obtain valid credentials or compromise an authorized user session. The AC:L (low attack complexity) and lack of user interaction (UI:N) indicate straightforward exploitation once authenticated. The S:U scope (unchanged) means impact is limited to the affected device. Compared to unauthenticated network RCEs, the authentication requirement significantly reduces opportunistic exploitation, but this remains a high-priority fix for any device with exposed or weak web credentials, particularly in IoT/network appliance environments where default credentials are common. The absence of confirmed CISA KEV listing suggests active exploitation may be limited or targeted rather than widespread.

An attacker with valid credentials to the Wavlink NU516U1 web interface accesses /cgi-bin/adm.cgi and crafts a malicious HTTP request with a wzdap function call that injects OS commands into the EncrypType or wl_Pass parameters, such as EncrypType=WPA2';reboot;' or wl_Pass=test$(cat /etc/passwd). The unsanitized parameter is passed directly to a shell command execution context, allowing the attacker to break out and execute arbitrary commands (e.g., reverse shell, credential exfiltration, device compromise) with web server privileges. If the web server runs as root (common in embedded systems), full device control is achieved.