Wavlink NU516U1 EUVD-2026-28976

An attacker must have authenticated access to the device management interface - a valid username and password or active session cookie is required (CVSS PR:L confirms authenticated requirement). No special device configuration or non-default settings are required beyond standard operation; the wireless.cgi endpoint and advance function are present in the affected firmware version 240425. The attack is not limited by user interaction (UI:N); automated attacks are feasible. Network accessibility to the management interface (HTTP/HTTPS port) is required. The constraint of authentication limits exploitation to scenarios involving compromised credentials, insider threats, weak default credentials, or local network attackers with device access.

CVSS 6.3 reflects network-accessible vulnerability (AV:N) with low complexity (AC:L) but requires authenticated access (PR:L), yielding moderate impact to confidentiality, integrity, and availability. EPSS score not provided. The CVSS vector indicates this is not unauthenticated network RCE - an attacker must have valid credentials or session access to trigger exploitation. However, risk is elevated by: (1) publicly available exploit code documented on GitHub; (2) vendor early notification suggesting this is not a zero-day; (3) the ease of parameter manipulation in web-based interfaces. The limiting factor - requirement for authenticated access (PR:L) - significantly reduces real-world risk compared to unauthenticated RCE, but in scenarios where device management accounts are weak, shared, or compromised, this becomes a critical internal threat vector. The E:P (Exploit Proof-of-Concept) rating in CVSS confirms POC availability. Organizations with exposed NU516U1 devices should prioritize based on account credential hygiene and network segmentation, not raw CVSS score.

An attacker with valid credentials to the Wavlink NU516U1 device management interface navigates to or crafts an HTTP request to /cgi-bin/wireless.cgi with the advance function and injects OS commands into the wlan_conf/Channel/skiplist/ieee_80211h parameter, such as 'value; rm -rf /' or 'value && cat /etc/passwd > /tmp/creds'. The unsanitized parameter is passed directly to a shell, causing the injected commands to execute with the privileges of the web server process (often root on embedded devices).