Wavlink NU516U1 EUVD-2026-28975

Exploitation requires authenticated access to the Wavlink NU516U1 device management interface (PR:L in CVSS vector). The attacker must possess valid credentials or an active authenticated session to the web interface at /cgi-bin/adm.cgi. The wzdapMesh function must be accessible and parameter validation must be absent or bypassable. No special device configuration is required beyond default operation; the vulnerability exists in the baseline firmware. Non-default configuration or access restrictions (firewall blocking CGI access) would prevent exploitation.

The CVSS 6.3 score (Medium severity) reflects a network-accessible vulnerability requiring low privileges (authenticated access) with low complexity exploitation. The CVSS vector indicates: AV:N (remote network vector), AC:L (low attack complexity), PR:L (low privilege requirement - authenticated user), UI:N (no user interaction), S:U (unchanged scope), with C:L/I:L/A:L (confidentiality, integrity, and availability all limited). The 'E:P' proof-of-concept tag and publicly available exploit code confirm real-world exploitation feasibility. However, the authentication requirement (PR:L) significantly limits real-world risk compared to unauthenticated vulnerabilities, as attackers must first obtain valid credentials or compromise an authenticated session. The CVSS RL:X (remediation level not specified) and RC:R (reasonable confidence) suggest vendor remediation pathway is unclear. Risk is moderate for deployments where device access is restricted to trusted networks; higher for devices exposed to untrusted users or in BYOD environments.

An authenticated attacker with access to the Wavlink NU516U1 web management interface sends a specially crafted HTTP request to /cgi-bin/adm.cgi with malicious OS command syntax injected into the wzdapMesh parameter. The unvalidated input is executed by the device's shell, allowing the attacker to read sensitive files, modify device configuration, or establish persistent access. The publicly available exploit code simplifies this attack, enabling attackers with basic HTTP knowledge to execute arbitrary commands.