Wavlink NU516U1 EUVD-2026-28977

Successful exploitation requires: (1) network-level access to the device's administrative interface (typically HTTP on port 80 or 443); (2) valid administrative credentials or authentication bypass; (3) the /cgi-bin/wireless.cgi endpoint must be accessible and processing requests to the WifiBasic function; (4) the AuthMethod or EncrypType parameters must be passed to the function without proper input sanitization. The attack is NOT possible against default configurations if strong authentication is enforced, but IS highly feasible if default credentials remain unchanged (common in deployed access points). No special network configuration or non-default deployment mode is required beyond standard web-based device management.

CVSS 6.3 with AV:N/AC:L/PR:L indicates network-accessible remote exploitation requiring only low-privilege authentication and no user interaction. However, the requirement for authenticated access (PR:L) significantly reduces real-world risk compared to unauthenticated network exploits. EPSS data is not provided, but the E:P and RC:R indicators in the vector suggest proof-of-concept exists and reproducibility is reasonable. The presence of publicly available exploit code on GitHub, combined with authenticated-only access requirements, positions this as a moderate priority for users who have weak or default credentials on their devices, or for attackers with prior network access. The lack of KEV status confirmation and absence of vendor patch information suggest limited active exploitation at scale, but the public exploit availability means motivated attackers can trivially exploit devices with default/weak administrative credentials. This is primarily a threat to devices exposed to untrusted networks or with compromised credentials.

An attacker with knowledge of valid administrative credentials (obtained through social engineering, credential stuffing, or network reconnaissance) authenticates to the Wavlink NU516U1 management interface and navigates to wireless configuration settings. They submit a crafted request to /cgi-bin/wireless.cgi with injected OS commands embedded in the AuthMethod or EncrypType parameters (e.g., 'WPA2; id #' or similar payloads). The vulnerable WifiBasic function executes these commands with the privileges of the web service, allowing the attacker to read sensitive files, modify configurations, or establish persistence on the device.