Wl Nu516U1
Monthly
Stack-based buffer overflow in the Wavlink WL-NU516U1 NAS device's nas.cgi password change handler allows remote unauthenticated attackers to potentially execute arbitrary code by supplying an oversized User1Passwd argument to the change_password function. Affecting the MT7628 firmware variant (708c073-mt7628), this carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact and no privileges or user interaction required. A public proof-of-concept has been published and a vendor-released firmware patch is available as of 2026-07-13; no confirmed CISA KEV listing at time of analysis.
Stack-based buffer overflow in the Wavlink WL-NU516U1 (firmware 708c073-mt7628) router's nas.cgi handler lets remote unauthenticated attackers overflow a fixed-size stack buffer by manipulating the HTTP CONTENT_LENGTH value processed via fgets. Successful exploitation can crash the device or execute arbitrary code with full compromise of confidentiality, integrity, and availability. A public write-up (GitHub report2.md) exists, but the flaw is not listed in CISA KEV - no public weaponized exploit is confirmed at time of analysis.
Remote attackers can exploit a stack-based buffer overflow in the /cgi-bin/nas.cgi endpoint of Wavlink WL-NU516U1 by manipulating the Content-Length parameter to achieve unauthenticated remote code execution. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. Authentication is required to trigger the flaw, limiting exposure to authenticated users or those with network access to the device.
OS command injection in the Wavlink WL-NU516U1 router's admin password handler allows a remote, low-privileged authenticated attacker to execute arbitrary operating system commands via the set_sys_adm function in adm.cgi. The affected firmware version is 708c073-mt7628, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the vendor has responded promptly and released a patched firmware dated 2026-07-13.
OS command injection in the Wavlink WL-NU516U1 firmware (build 708c073-mt7628) allows remote attackers to execute arbitrary operating system commands by supplying a crafted Password argument to the Config Import component. The CVSS 4.0 score of 7.7 reflects meaningful constraints - high attack complexity (AC:H) and required user interaction (UI:P) - yet the full confidentiality, integrity, and availability impact on the vulnerable system remains high. A proof-of-concept exploit has been publicly published on GitHub, and the vendor has already released a patched firmware binary, making this a time-sensitive patching priority for any deployment of the affected firmware build.
OS command injection in the Wavlink WL-NU516U1 router's CGI web administration interface allows authenticated network attackers to execute arbitrary operating system commands by injecting shell metacharacters into the lan_ip parameter of the adm.cgi endpoint. The wlink_uci_set_value function passes attacker-controlled input unsanitized into OS-level commands, enabling full compromise of the underlying Linux-based router OS. A public proof-of-concept exploit is available on GitHub (no public exploit identified at time of analysis for KEV), and the vendor has released a patched firmware as of June 22, 2026.
A vulnerability was found in Wavlink WL-NU516U1 240425.
Stack-based buffer overflow in the Wavlink WL-NU516U1 NAS device's nas.cgi password change handler allows remote unauthenticated attackers to potentially execute arbitrary code by supplying an oversized User1Passwd argument to the change_password function. Affecting the MT7628 firmware variant (708c073-mt7628), this carries a CVSS 4.0 score of 8.9 with full confidentiality, integrity, and availability impact and no privileges or user interaction required. A public proof-of-concept has been published and a vendor-released firmware patch is available as of 2026-07-13; no confirmed CISA KEV listing at time of analysis.
Stack-based buffer overflow in the Wavlink WL-NU516U1 (firmware 708c073-mt7628) router's nas.cgi handler lets remote unauthenticated attackers overflow a fixed-size stack buffer by manipulating the HTTP CONTENT_LENGTH value processed via fgets. Successful exploitation can crash the device or execute arbitrary code with full compromise of confidentiality, integrity, and availability. A public write-up (GitHub report2.md) exists, but the flaw is not listed in CISA KEV - no public weaponized exploit is confirmed at time of analysis.
Remote attackers can exploit a stack-based buffer overflow in the /cgi-bin/nas.cgi endpoint of Wavlink WL-NU516U1 by manipulating the Content-Length parameter to achieve unauthenticated remote code execution. Public exploit code is available for this vulnerability, and no patch has been released despite vendor notification. Authentication is required to trigger the flaw, limiting exposure to authenticated users or those with network access to the device.
OS command injection in the Wavlink WL-NU516U1 router's admin password handler allows a remote, low-privileged authenticated attacker to execute arbitrary operating system commands via the set_sys_adm function in adm.cgi. The affected firmware version is 708c073-mt7628, and a public proof-of-concept exploit has been disclosed on GitHub. No CISA KEV listing exists, but the vendor has responded promptly and released a patched firmware dated 2026-07-13.
OS command injection in the Wavlink WL-NU516U1 firmware (build 708c073-mt7628) allows remote attackers to execute arbitrary operating system commands by supplying a crafted Password argument to the Config Import component. The CVSS 4.0 score of 7.7 reflects meaningful constraints - high attack complexity (AC:H) and required user interaction (UI:P) - yet the full confidentiality, integrity, and availability impact on the vulnerable system remains high. A proof-of-concept exploit has been publicly published on GitHub, and the vendor has already released a patched firmware binary, making this a time-sensitive patching priority for any deployment of the affected firmware build.
OS command injection in the Wavlink WL-NU516U1 router's CGI web administration interface allows authenticated network attackers to execute arbitrary operating system commands by injecting shell metacharacters into the lan_ip parameter of the adm.cgi endpoint. The wlink_uci_set_value function passes attacker-controlled input unsanitized into OS-level commands, enabling full compromise of the underlying Linux-based router OS. A public proof-of-concept exploit is available on GitHub (no public exploit identified at time of analysis for KEV), and the vendor has released a patched firmware as of June 22, 2026.
A vulnerability was found in Wavlink WL-NU516U1 240425.