EUVD-2026-52167
GHSA-hfj9-7vrj-jwv3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconReach router HTTP interface
-
DeliverySend crafted request to nas.cgi
-
ExploitSet oversized CONTENT_LENGTH argument
-
InstallOverflow stack buffer via fgets
-
C2Overwrite saved return address
-
ExecuteExecute arbitrary code / crash device
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the device's HTTP service and the ability to reach the nas.cgi endpoint (the NAS/USB management handler); the attacker sends a request whose CONTENT_LENGTH argument is set to an oversized value to overflow the fgets stack buffer. Per CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N, no authentication, no user interaction, and no special attack requirements are needed against the affected firmware. What limits exploitation in practice is reachability: the router's management/NAS interface must be accessible to the attacker (WAN-exposed, or same LAN/adjacent network), and the target must run the vulnerable 708c073-mt7628 firmware; devices with the NAS feature disabled or the interface firewalled off the untrusted side are not remotely reachable at this endpoint. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H, base 9.3) describes a network-reachable, low-complexity, unauthenticated attack with total impact - a genuine high priority where the device is exposed. Signals partially conflict on real-world urgency: a vendor patch is available and a public technical write-up exists (raising exploit feasibility), but there is no CISA KEV listing and no EPSS score was provided, so active mass exploitation is not evidenced. Net assessment: technically severe and readily exploitable against reachable devices, but real risk is bounded by exposure - the primary threat surface is units with the web/NAS interface reachable from the WAN or an untrusted LAN, which for a consumer router is more likely internal/adjacent than internet-wide. EPSS is missing; do not assume widespread automated exploitation without it. |
| Exploit ScenarioDerived | An attacker with network reachability to the router's web interface sends a single crafted HTTP request to nas.cgi with an oversized CONTENT_LENGTH value, overflowing the stack buffer parsed by fgets. Because no authentication or user interaction is required (PR:N/UI:N), this can crash the device or, on this unmitigated MIPS platform, redirect execution to attacker-supplied code. A public technical write-up describing the flaw is available, lowering the effort required to reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 03, 2026
Stack-based buffer overflow in the Wavlink WL-NU516U1 (firmware 708c073-mt7628) router's nas.cgi handler lets remote unauthenticated attackers overflow a fixed-size stack buffer by manipulating the HTTP CONTENT_LENGTH value processed via fgets. Successful exploitation can crash the device or execute arbitrary code with full compromise of confidentiality, integrity, and availability. A public write-up (GitHub report2.md) exists, but the flaw is not listed in CISA KEV - no public weaponized exploit is confirmed at time of analysis.
RemediationAI
Patch available per vendor advisory - the vendor was contacted early and released a fixed firmware image, available at https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin; apply this sysupgrade firmware (build 4b8a21f-mt7628, dated 2026-07-13) as the primary fix. Until updating, reduce exposure by ensuring the router's web/NAS management interface is not reachable from the WAN (disable remote/WAN administration), and restrict access to the LAN-side management interface to trusted hosts only. If the NAS/USB feature is unused, disable it to remove the nas.cgi attack surface; the trade-off is loss of network storage functionality. Note that blocking or filtering management ports on the LAN may disrupt legitimate administration, so validate connectivity after applying controls.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is nas.cgi, a CGI binary that provides NAS/USB-storage management on the Wavlink WL-NU516U1, a MediaTek MT7628-based SOHO wireless router/USB adapter running an embedded Linux (MIPS) firmware. The vulnerability is CWE-121 (stack-based buffer overflow): the code reads the attacker-controlled CONTENT_LENGTH CGI/environment value into a fixed-size stack buffer via fgets without adequate bounds enforcement, so an oversized value corrupts the stack frame, saved registers, and return address. On MIPS embedded targets lacking modern exploit mitigations (often no ASLR/NX or weak protections), such overflows are frequently escalated from denial of service to remote code execution.
Know when Wl Nu516U1 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated network request to nas.cgi (AV:N/AC:L/PR:N/UI:N); stack overflow enabling code execution on the device yields full C/I/A impact with no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT_LENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Executive ViewAI
The Wavlink WL-NU516U1 router contains a critical remote code execution vulnerability (CVE-2026-18588, CVSS 9.3) enabling unauthenticated network attackers to fully compromise affected devices. Any internet-exposed Wavlink routers in your infrastructure require immediate patching to prevent unauthorized access to network resources and systems.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Wl Nu516U1
View allRemote attackers can exploit a stack-based buffer overflow in the /cgi-bin/nas.cgi endpoint of Wavlink WL-NU516U1 by man
Stack-based buffer overflow in the Wavlink WL-NU516U1 NAS device's nas.cgi password change handler allows remote unauthe
OS command injection in the Wavlink WL-NU516U1 firmware (build 708c073-mt7628) allows remote attackers to execute arbitr
OS command injection in the Wavlink WL-NU516U1 router's CGI web administration interface allows authenticated network at
A vulnerability was found in Wavlink WL-NU516U1 240425.
OS command injection in the Wavlink WL-NU516U1 router's admin password handler allows a remote, low-privileged authentic
Exploit-DB