Wavlink WL-NU516U1 EUVD-2026-52160

The Config Import feature of the WL-NU516U1 web interface must be reachable by the attacker over the network. User interaction is required (UI:P per CVSS 4.0), meaning the attack likely requires a legitimate user to initiate or approve an import action, or the attacker must manipulate a user into submitting a crafted configuration. High attack complexity (AC:H) indicates that specific preconditions - such as device state, session timing, or multi-step interaction - must align for exploitation to succeed. Exploitation is constrained to firmware build 708c073-mt7628 specifically; devices updated to the 2026-07-13 patched firmware are not affected. No authentication bypass is indicated in the available data; however, if Config Import is accessible pre-authentication (PR:N in the vector), no login credentials are required - this has not been independently confirmed beyond the CVSS vector assignment.

The CVSS 4.0 score of 7.7 accurately reflects a meaningful but conditionally exploitable vulnerability. The AV:N metric confirms the attack is network-reachable, but AC:H signals that exploitation requires specific conditions or multi-step interaction not trivially reproducible against arbitrary targets. The UI:P requirement further constrains opportunistic mass exploitation. No CISA KEV listing is present in the available data, and no EPSS score was provided. However, the E:P environmental metric in the CVSS 4.0 vector confirms publicly available exploit code, corroborated by the GitHub proof-of-concept report. The net assessment is a credible but not trivially weaponizable vulnerability: realistic against a targeted device where an attacker can influence or wait for user interaction, but not a candidate for automated scanning campaigns. The vendor's rapid response and already-released patch shift the priority squarely to patching rather than compensating controls.

An attacker who can reach the WL-NU516U1 web management interface - either directly exposed or via a compromised LAN host - submits a crafted Config Import request embedding OS command injection payloads (e.g., semicolon-delimited shell commands) in the Password field. The firmware's config import handler passes the unsanitized value to a shell call, executing the injected commands under the device's runtime privilege context. The published proof-of-concept on GitHub (https://github.com/oduoke567/WAVLINK-NU516U1-2026-05-1/blob/main/report.md) demonstrates the technique, lowering the skill threshold for exploitation, though the high attack complexity and user interaction requirement mean the attack is more likely targeted than opportunistic.