Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
337 vulnerabilities by wavlink
CVE-2026-74843 (GCVE-0-2026-74843)
Vulnerability from nvd – Published: 2026-08-17 11:15 – Updated: 2026-08-17 14:44
VLAI
EPSS
VEX
Title
Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow
Summary
A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTP_COOKIE can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 14:44 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391205 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/391205/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-74843 | third-party-advisory |
| https://vuldb.com/submit/875331 | third-party-advisory |
| https://github.com/wcndsb-sketch/WAVLINK_WN535M1-… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74843",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T14:44:47.207405Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T14:44:57.952Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:wavlink:wn531p3:*:*:*:*:*:*:*:*"
],
"modules": [
"Export Pingortrace CGI"
],
"product": "WN531P3",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "V250922"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn535m1:*:*:*:*:*:*:*:*"
],
"modules": [
"Export Pingortrace CGI"
],
"product": "WN535M1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "V250922"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "world5 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTP_COOKIE can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T11:15:08.412Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391205 | Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/391205"
},
{
"name": "VDB-391205 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391205/cti"
},
{
"name": "CVE-2026-74843 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-74843"
},
{
"name": "Submit #875331 | Wavlink WAVLINK_WN535M1-M35M1_V250922 V250922 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/875331"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wcndsb-sketch/WAVLINK_WN535M1-M35M1_V250922-Buffer-Overflow/blob/main/CVE-Report-WAVLINK-WN535M1-RCE.pdf"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-17T06:54:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-74843",
"datePublished": "2026-08-17T11:15:08.412Z",
"dateReserved": "2026-08-17T04:49:13.431Z",
"dateUpdated": "2026-08-17T14:44:57.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18607 (GCVE-0-2026-18607)
Vulnerability from nvd – Published: 2026-08-03 16:45 – Updated: 2026-08-03 20:23
VLAI
EPSS
VEX
Title
Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow
Summary
A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 20:22 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385530 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385530/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18607 | third-party-advisory |
| https://vuldb.com/submit/852637 | third-party-advisory |
| https://github.com/0xcc12138/WAVLINK-vul | exploit |
Impacted products
12 products
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WN572 |
Affected:
20260609
cpe:2.3:a:wavlink:wn572:*:*:*:*:*:*:*:* |
|
| Wavlink | WN570H |
Affected:
20260609
cpe:2.3:a:wavlink:wn570h:*:*:*:*:*:*:*:* |
|
| Wavlink | WN573 |
Affected:
20260609
cpe:2.3:a:wavlink:wn573:*:*:*:*:*:*:*:* |
|
| Wavlink | WN529 |
Affected:
20260609
cpe:2.3:a:wavlink:wn529:*:*:*:*:*:*:*:* |
|
| Wavlink | WN530 |
Affected:
20260609
cpe:2.3:a:wavlink:wn530:*:*:*:*:*:*:*:* |
|
| Wavlink | WN531 |
Affected:
20260609
cpe:2.3:a:wavlink:wn531:*:*:*:*:*:*:*:* |
|
| Wavlink | WN535 |
Affected:
20260609
cpe:2.3:a:wavlink:wn535:*:*:*:*:*:*:*:* |
|
| Wavlink | etc. WN529 |
Affected:
20260609
cpe:2.3:a:wavlink:etc._wn529:*:*:*:*:*:*:*:* |
|
| Wavlink | WN536 |
Affected:
20260609
cpe:2.3:a:wavlink:wn536:*:*:*:*:*:*:*:* |
|
| Wavlink | WN551 |
Affected:
20260609
cpe:2.3:a:wavlink:wn551:*:*:*:*:*:*:*:* |
|
| Wavlink | WN557 |
Affected:
20260609
cpe:2.3:a:wavlink:wn557:*:*:*:*:*:*:*:* |
|
| Wavlink | NU516 |
Affected:
20260609
cpe:2.3:a:wavlink:nu516:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18607",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T20:22:57.235846Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T20:23:24.093Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:wavlink:wn572:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN572",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn570h:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN570H",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn573:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN573",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn529:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN529",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn530:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN530",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn531:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN531",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn535:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN535",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:etc._wn529:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "etc. WN529",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn530:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN530",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn531:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN531",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn535:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN535",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn536:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN536",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn551:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN551",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn557:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN557",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:nu516:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "NU516",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "0xcc12138 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:45:09.268Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385530 | Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385530"
},
{
"name": "VDB-385530 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385530/cti"
},
{
"name": "CVE-2026-18607 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18607"
},
{
"name": "Submit #852637 | WAVLINK Multiple Router Series (WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc.) WN529, WN530, WN531, WN535, WN536, WN551, WN557, NU516,and so on Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/852637"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/0xcc12138/WAVLINK-vul"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-03T09:22:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18607",
"datePublished": "2026-08-03T16:45:09.268Z",
"dateReserved": "2026-08-03T07:17:39.882Z",
"dateUpdated": "2026-08-03T20:23:24.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18590 (GCVE-0-2026-18590)
Vulnerability from nvd – Published: 2026-08-03 06:45 – Updated: 2026-08-03 15:37
VLAI
EPSS
VEX
Title
Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection
Summary
A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 13:47 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385418 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385418/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18590 | third-party-advisory |
| https://vuldb.com/submit/850527 | third-party-advisory |
| https://vuldb.com/submit/850560 | third-party-advisory |
| https://github.com/oduoke567/WAVLINK-NU516U1-2026… | broken-link |
| https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U… | broken-linkpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WL-NU516U1 |
Affected:
708c073-mt7628
cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T13:47:31.761282Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:37:14.370Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"Admin Password Handler"
],
"product": "WL-NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "708c073-mt7628"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "oduoke (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T06:45:10.041Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385418 | Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385418"
},
{
"name": "VDB-385418 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385418/cti"
},
{
"name": "CVE-2026-18590 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18590"
},
{
"name": "Submit #850527 | WAVLINK NU516U1 2026-05-15 (build 708c073-mt7628) Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/850527"
},
{
"name": "Submit #850560 | WAVLINK NU516U1 2026-05-15 (build 708c073-mt7628) Command Injection (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/850560"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/oduoke567/WAVLINK-NU516U1-2026-05-1/blob/main/report2.md"
},
{
"tags": [
"broken-link",
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-02T22:39:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18590",
"datePublished": "2026-08-03T06:45:10.041Z",
"dateReserved": "2026-08-02T20:33:59.442Z",
"dateUpdated": "2026-08-03T15:37:14.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18589 (GCVE-0-2026-18589)
Vulnerability from nvd – Published: 2026-08-03 06:30 – Updated: 2026-08-03 19:59
VLAI
EPSS
VEX
Title
Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow
Summary
A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
9.8 (Critical)
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 19:59 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385417 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385417/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18589 | third-party-advisory |
| https://vuldb.com/submit/850501 | third-party-advisory |
| https://github.com/oduoke567/WAVLINK-NU516U1-2026… | broken-link |
| https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U… | broken-linkpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WL-NU516U1 |
Affected:
708c073-mt7628
cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18589",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:59:34.049827Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:59:44.346Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:*"
],
"product": "WL-NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "708c073-mt7628"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "oduoke (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T06:30:10.498Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385417 | Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385417"
},
{
"name": "VDB-385417 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385417/cti"
},
{
"name": "CVE-2026-18589 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18589"
},
{
"name": "Submit #850501 | WAVLINK NU516U1 2026-05-15 (build 708c073-mt7628) Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/850501"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/oduoke567/WAVLINK-NU516U1-2026-05-1/blob/main/report2.md"
},
{
"tags": [
"broken-link",
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-02T22:38:50.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18589",
"datePublished": "2026-08-03T06:30:10.498Z",
"dateReserved": "2026-08-02T20:33:42.866Z",
"dateUpdated": "2026-08-03T19:59:44.346Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18588 (GCVE-0-2026-18588)
Vulnerability from nvd – Published: 2026-08-03 06:00 – Updated: 2026-08-03 15:03
VLAI
EPSS
VEX
Title
Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow
Summary
A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT_LENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
9.8 (Critical)
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 14:59 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385416 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385416/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18588 | third-party-advisory |
| https://vuldb.com/submit/850500 | third-party-advisory |
| https://github.com/oduoke567/WAVLINK-NU516U1-2026… | broken-link |
| https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U… | broken-linkpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WL-NU516U1 |
Affected:
708c073-mt7628
cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18588",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T14:59:51.052277Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:03:20.669Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/850500"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:*"
],
"product": "WL-NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "708c073-mt7628"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "oduoke (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT_LENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T06:00:11.107Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385416 | Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385416"
},
{
"name": "VDB-385416 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385416/cti"
},
{
"name": "CVE-2026-18588 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18588"
},
{
"name": "Submit #850500 | WAVLINK WL-NU516U1 2026-05-15 (build 708c073-mt7628) Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/850500"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/oduoke567/WAVLINK-NU516U1-2026-05-1/blob/main/report2.md"
},
{
"tags": [
"broken-link",
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-02T22:38:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18588",
"datePublished": "2026-08-03T06:00:11.107Z",
"dateReserved": "2026-08-02T20:33:29.434Z",
"dateUpdated": "2026-08-03T15:03:20.669Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18587 (GCVE-0-2026-18587)
Vulnerability from nvd – Published: 2026-08-03 05:45 – Updated: 2026-08-03 20:16
VLAI
EPSS
VEX
Title
Wavlink WL-NU516U1 Config Import os command injection
Summary
A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been published and may be used. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 20:16 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385415 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385415/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18587 | third-party-advisory |
| https://vuldb.com/submit/850494 | third-party-advisory |
| https://github.com/oduoke567/WAVLINK-NU516U1-2026… | broken-link |
| https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U… | broken-linkpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WL-NU516U1 |
Affected:
708c073-mt7628
cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18587",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T20:16:13.207043Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T20:16:37.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/850494"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"Config Import"
],
"product": "WL-NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "708c073-mt7628"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "oduoke (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been published and may be used. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.6,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T05:45:11.360Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385415 | Wavlink WL-NU516U1 Config Import os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385415"
},
{
"name": "VDB-385415 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385415/cti"
},
{
"name": "CVE-2026-18587 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18587"
},
{
"name": "Submit #850494 | WAVLINK WL-NU516U1 2026-05-15 (build 708c073-mt7628) Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/850494"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/oduoke567/WAVLINK-NU516U1-2026-05-1/blob/main/report.md"
},
{
"tags": [
"broken-link",
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-02T22:38:32.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WL-NU516U1 Config Import os command injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18587",
"datePublished": "2026-08-03T05:45:11.360Z",
"dateReserved": "2026-08-02T20:33:24.850Z",
"dateUpdated": "2026-08-03T20:16:37.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15513 (GCVE-0-2026-15513)
Vulnerability from nvd – Published: 2026-07-12 23:30 – Updated: 2026-07-13 15:24
VLAI
EPSS
VEX
Title
Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection
Summary
A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lan_ip results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-13 15:24 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/377842 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/377842/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-15513 | third-party-advisory |
| https://vuldb.com/submit/847517 | third-party-advisory |
| https://github.com/0xcc12138/wavlink-nu516u1-csrf… | exploit |
| https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WL-NU516U1 |
Affected:
260515
cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15513",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T15:24:03.623706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T15:24:17.623Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:*"
],
"product": "WL-NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "260515"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "0xcc12138 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lan_ip results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-12T23:30:15.048Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-377842 | Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/377842"
},
{
"name": "VDB-377842 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/377842/cti"
},
{
"name": "CVE-2026-15513 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-15513"
},
{
"name": "Submit #847517 | WAVLINK NU516U1 M16U1_V260515 OS Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/847517"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/0xcc12138/wavlink-nu516u1-csrf-command-injection-"
},
{
"tags": [
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-12T08:31:31.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-15513",
"datePublished": "2026-07-12T23:30:15.048Z",
"dateReserved": "2026-07-12T06:26:27.054Z",
"dateUpdated": "2026-07-13T15:24:17.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13539 (GCVE-0-2026-13539)
Vulnerability from nvd – Published: 2026-06-29 05:30 – Updated: 2026-06-29 14:52
VLAI
EPSS
VEX
Title
Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_407504 stack-based overflow
Summary
A vulnerability was identified in Wavlink WL-NU516U1-A M16U1_V240425. The impacted element is the function sub_407504 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. Such manipulation of the argument Guest_ssid leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-29 14:13 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/374547 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/374547/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-13539 | third-party-advisory |
| https://vuldb.com/submit/834024 | third-party-advisory |
| https://github.com/Svigo-o/Wavlink_vul/tree/main/… | exploit |
| https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WL-NU516U1-A |
Affected:
M16U1_V240425
cpe:2.3:a:wavlink:wl-nu516u1-a:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13539",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-29T14:13:41.239265Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T14:52:41.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:wavlink:wl-nu516u1-a:*:*:*:*:*:*:*:*"
],
"modules": [
"POST Parameter Handler"
],
"product": "WL-NU516U1-A",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "M16U1_V240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "JuneGu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Wavlink WL-NU516U1-A M16U1_V240425. The impacted element is the function sub_407504 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. Such manipulation of the argument Guest_ssid leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T05:30:09.451Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-374547 | Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_407504 stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/374547"
},
{
"name": "VDB-374547 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/374547/cti"
},
{
"name": "CVE-2026-13539 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-13539"
},
{
"name": "Submit #834024 | Wavlink WL-NU516U1-A M16U1_V240425 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834024"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Svigo-o/Wavlink_vul/tree/main/wavlink-wl-nu516u1-wireless-guestwifi-guestssid-buffer-overflow"
},
{
"tags": [
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-28T12:07:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_407504 stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-13539",
"datePublished": "2026-06-29T05:30:09.451Z",
"dateReserved": "2026-06-28T10:01:38.197Z",
"dateUpdated": "2026-06-29T14:52:41.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13538 (GCVE-0-2026-13538)
Vulnerability from nvd – Published: 2026-06-29 05:15 – Updated: 2026-06-29 13:48
VLAI
EPSS
VEX
Title
Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection
Summary
A vulnerability was determined in Wavlink WL-NU516U1-A M16U1_V240425. The affected element is the function sub_401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-29 13:47 UTC
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/374546 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/374546/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-13538 | third-party-advisory |
| https://vuldb.com/submit/834019 | third-party-advisory |
| https://vuldb.com/submit/834021 | third-party-advisory |
| https://vuldb.com/submit/834022 | third-party-advisory |
| https://vuldb.com/submit/834023 | third-party-advisory |
| https://github.com/Svigo-o/Wavlink_vul/tree/main/… | related |
| https://github.com/Svigo-o/Wavlink_vul/tree/main/… | exploit |
| https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WL-NU516U1-A |
Affected:
M16U1_V240425
cpe:2.3:a:wavlink:wl-nu516u1-a:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13538",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-29T13:47:32.393217Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T13:48:00.057Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:wavlink:wl-nu516u1-a:*:*:*:*:*:*:*:*"
],
"modules": [
"POST Parameter Handler"
],
"product": "WL-NU516U1-A",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "M16U1_V240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "HustBinary (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Wavlink WL-NU516U1-A M16U1_V240425. The affected element is the function sub_401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T05:15:13.662Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-374546 | Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/374546"
},
{
"name": "VDB-374546 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/374546/cti"
},
{
"name": "CVE-2026-13538 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-13538"
},
{
"name": "Submit #834019 | Wavlink WL-NU516U1-A M16U1_V240425 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834019"
},
{
"name": "Submit #834021 | Wavlink WL-NU516U1-A M16U1_V240425 Command Injection (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834021"
},
{
"name": "Submit #834022 | Wavlink WL-NU516U1-A M16U1_V240425 Command Injection (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834022"
},
{
"name": "Submit #834023 | Wavlink WL-NU516U1-A M16U1_V240425 Command Injection (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834023"
},
{
"tags": [
"related"
],
"url": "https://github.com/Svigo-o/Wavlink_vul/tree/main/wavlink-wl-nu516u1-wireless-multissid-ssid2g2-command-injection"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Svigo-o/Wavlink_vul/tree/main/wavlink-wl-nu516u1-wireless-multissid-ssid5g2-command-injection"
},
{
"tags": [
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-28T12:06:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-13538",
"datePublished": "2026-06-29T05:15:13.662Z",
"dateReserved": "2026-06-28T10:01:35.649Z",
"dateUpdated": "2026-06-29T13:48:00.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8230 (GCVE-0-2026-8230)
Vulnerability from nvd – Published: 2026-05-10 04:30 – Updated: 2026-05-11 14:53
VLAI
EPSS
VEX
Title
Wavlink NU516U1 login.cgi sys_login1 os command injection
Summary
A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 14:53 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/362447 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/362447/cti | signaturepermissions-required |
| https://vuldb.com/submit/800735 | third-party-advisory |
| https://github.com/wudipjq/my_vuln/blob/main/Wavl… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8230",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T14:53:00.917278Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T14:53:10.116Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ziyue Xie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-10T04:30:09.029Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-362447 | Wavlink NU516U1 login.cgi sys_login1 os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/362447"
},
{
"name": "VDB-362447 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/362447/cti"
},
{
"name": "Submit #800735 | Wavlink NU516U1 M16U1_V240425 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/800735"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_9/9.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-09T10:00:11.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink NU516U1 login.cgi sys_login1 os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8230",
"datePublished": "2026-05-10T04:30:09.029Z",
"dateReserved": "2026-05-09T07:54:57.297Z",
"dateUpdated": "2026-05-11T14:53:10.116Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8229 (GCVE-0-2026-8229)
Vulnerability from nvd – Published: 2026-05-10 04:15 – Updated: 2026-05-11 15:00
VLAI
EPSS
VEX
Title
Wavlink NU516U1 wireless.cgi WifiBasic os command injection
Summary
A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument AuthMethod/EncrypType results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 15:00 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/362446 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/362446/cti | signaturepermissions-required |
| https://vuldb.com/submit/800734 | third-party-advisory |
| https://github.com/wudipjq/my_vuln/blob/main/Wavl… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8229",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T15:00:14.128075Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T15:00:57.887Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ziyue Xie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument AuthMethod/EncrypType results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-10T04:15:09.652Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-362446 | Wavlink NU516U1 wireless.cgi WifiBasic os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/362446"
},
{
"name": "VDB-362446 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/362446/cti"
},
{
"name": "Submit #800734 | Wavlink NU516U1 M16U1_V240425 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/800734"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_8/8.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-09T10:00:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink NU516U1 wireless.cgi WifiBasic os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8229",
"datePublished": "2026-05-10T04:15:09.652Z",
"dateReserved": "2026-05-09T07:54:54.467Z",
"dateUpdated": "2026-05-11T15:00:57.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8228 (GCVE-0-2026-8228)
Vulnerability from nvd – Published: 2026-05-10 04:00 – Updated: 2026-05-12 02:33
VLAI
EPSS
VEX
Title
Wavlink NU516U1 wireless.cgi advance os command injection
Summary
A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlan_conf/Channel/skiplist/ieee_80211h leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-12 02:33 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/362445 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/362445/cti | signaturepermissions-required |
| https://vuldb.com/submit/800733 | third-party-advisory |
| https://github.com/wudipjq/my_vuln/blob/main/Wavl… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8228",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T02:33:06.220143Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T02:33:15.334Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ziyue Xie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlan_conf/Channel/skiplist/ieee_80211h leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-10T04:00:08.818Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-362445 | Wavlink NU516U1 wireless.cgi advance os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/362445"
},
{
"name": "VDB-362445 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/362445/cti"
},
{
"name": "Submit #800733 | Wavlink NU516U1 M16U1_V240425 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/800733"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_7/7.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-09T10:00:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink NU516U1 wireless.cgi advance os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8228",
"datePublished": "2026-05-10T04:00:08.818Z",
"dateReserved": "2026-05-09T07:54:51.721Z",
"dateUpdated": "2026-05-12T02:33:15.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8227 (GCVE-0-2026-8227)
Vulnerability from nvd – Published: 2026-05-10 03:45 – Updated: 2026-05-11 17:03
VLAI
EPSS
VEX
Title
Wavlink NU516U1 adm.cgi wzdapMesh os command injection
Summary
A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 17:02 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/362444 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/362444/cti | signaturepermissions-required |
| https://vuldb.com/submit/800732 | third-party-advisory |
| https://github.com/wudipjq/my_vuln/blob/main/Wavl… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8227",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T17:02:59.962404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T17:03:20.576Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ziyue Xie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-10T03:45:08.687Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-362444 | Wavlink NU516U1 adm.cgi wzdapMesh os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/362444"
},
{
"name": "VDB-362444 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/362444/cti"
},
{
"name": "Submit #800732 | Wavlink NU516U1 M16U1_V240425 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/800732"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_6/6.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-09T10:00:02.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink NU516U1 adm.cgi wzdapMesh os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8227",
"datePublished": "2026-05-10T03:45:08.687Z",
"dateReserved": "2026-05-09T07:54:49.022Z",
"dateUpdated": "2026-05-11T17:03:20.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8192 (GCVE-0-2026-8192)
Vulnerability from nvd – Published: 2026-05-09 18:30 – Updated: 2026-05-11 15:11
VLAI
EPSS
VEX
Title
Wavlink NU516U1 adm.cgi wzdap os command injection
Summary
A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. This vulnerability affects the function wzdap of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument EncrypType/wl_Pass is directly passed by the attacker/so we can control the EncrypType/wl_Pass results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 15:11 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/362344 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/362344/cti | signaturepermissions-required |
| https://vuldb.com/submit/800731 | third-party-advisory |
| https://github.com/wudipjq/my_vuln/blob/main/Wavl… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8192",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T15:11:11.582649Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T15:11:41.012Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "M16U1_V240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ziyue Xie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. This vulnerability affects the function wzdap of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument EncrypType/wl_Pass is directly passed by the attacker/so we can control the EncrypType/wl_Pass results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-09T18:30:11.631Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-362344 | Wavlink NU516U1 adm.cgi wzdap os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/362344"
},
{
"name": "VDB-362344 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/362344/cti"
},
{
"name": "Submit #800731 | Wavlink NU516U1 M16U1_V240425 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/800731"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_5/5.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-08T21:57:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink NU516U1 adm.cgi wzdap os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8192",
"datePublished": "2026-05-09T18:30:11.631Z",
"dateReserved": "2026-05-08T19:52:14.500Z",
"dateUpdated": "2026-05-11T15:11:41.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8191 (GCVE-0-2026-8191)
Vulnerability from nvd – Published: 2026-05-09 18:15 – Updated: 2026-05-12 02:25
VLAI
EPSS
VEX
Title
Wavlink NU516U1 adm.cgi wifi_region os command injection
Summary
A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-bin/adm.cgi. Such manipulation of the argument skiplist1/skiplist2 leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-12 02:25 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/362343 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/362343/cti | signaturepermissions-required |
| https://vuldb.com/submit/800730 | third-party-advisory |
| https://github.com/wudipjq/my_vuln/blob/main/Wavl… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8191",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T02:25:39.864299Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T02:25:52.944Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "M16U1_V240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ziyue Xie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-bin/adm.cgi. Such manipulation of the argument skiplist1/skiplist2 leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-09T18:15:10.184Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-362343 | Wavlink NU516U1 adm.cgi wifi_region os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/362343"
},
{
"name": "VDB-362343 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/362343/cti"
},
{
"name": "Submit #800730 | Wavlink NU516U1 M16U1_V240425 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/800730"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_4/4.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-08T21:57:26.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink NU516U1 adm.cgi wifi_region os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8191",
"datePublished": "2026-05-09T18:15:10.184Z",
"dateReserved": "2026-05-08T19:52:11.621Z",
"dateUpdated": "2026-05-12T02:25:52.944Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8190 (GCVE-0-2026-8190)
Vulnerability from nvd – Published: 2026-05-09 17:15 – Updated: 2026-05-11 17:21
VLAI
EPSS
VEX
Title
Wavlink NU516U1 adm.cgi wan os command injection
Summary
A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. Affected by this issue is the function wan of the file /cgi-bin/adm.cgi. This manipulation of the argument ppp_username/ppp_passwd/rwan_ip/rwan_mask/rwan_gateway is directly passed by the attacker/so we can control the ppp_username/ppp_passwd/rwan_ip/rwan_mask/rwan_gateway causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 17:12 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/362342 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/362342/cti | signaturepermissions-required |
| https://vuldb.com/submit/800729 | third-party-advisory |
| https://github.com/wudipjq/my_vuln/blob/main/Wavl… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8190",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T17:12:29.304618Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T17:21:24.425Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "M16U1_V240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ziyue Xie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. Affected by this issue is the function wan of the file /cgi-bin/adm.cgi. This manipulation of the argument ppp_username/ppp_passwd/rwan_ip/rwan_mask/rwan_gateway is directly passed by the attacker/so we can control the ppp_username/ppp_passwd/rwan_ip/rwan_mask/rwan_gateway causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-09T17:15:08.656Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-362342 | Wavlink NU516U1 adm.cgi wan os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/362342"
},
{
"name": "VDB-362342 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/362342/cti"
},
{
"name": "Submit #800729 | Wavlink NU516U1 M16U1_V240425 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/800729"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_3/3.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-08T21:57:24.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink NU516U1 adm.cgi wan os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8190",
"datePublished": "2026-05-09T17:15:08.656Z",
"dateReserved": "2026-05-08T19:52:08.350Z",
"dateUpdated": "2026-05-11T17:21:24.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74843 (GCVE-0-2026-74843)
Vulnerability from cvelistv5 – Published: 2026-08-17 11:15 – Updated: 2026-08-17 14:44
VLAI
EPSS
VEX
Title
Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow
Summary
A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTP_COOKIE can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-17 14:44 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/391205 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/391205/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-74843 | third-party-advisory |
| https://vuldb.com/submit/875331 | third-party-advisory |
| https://github.com/wcndsb-sketch/WAVLINK_WN535M1-… | exploit |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74843",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-17T14:44:47.207405Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T14:44:57.952Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:wavlink:wn531p3:*:*:*:*:*:*:*:*"
],
"modules": [
"Export Pingortrace CGI"
],
"product": "WN531P3",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "V250922"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn535m1:*:*:*:*:*:*:*:*"
],
"modules": [
"Export Pingortrace CGI"
],
"product": "WN535M1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "V250922"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "world5 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi of the component Export Pingortrace CGI. Executing a manipulation of the argument HTTP_COOKIE can lead to stack-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-17T11:15:08.412Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-391205 | Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/391205"
},
{
"name": "VDB-391205 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/391205/cti"
},
{
"name": "CVE-2026-74843 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-74843"
},
{
"name": "Submit #875331 | Wavlink WAVLINK_WN535M1-M35M1_V250922 V250922 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/875331"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wcndsb-sketch/WAVLINK_WN535M1-M35M1_V250922-Buffer-Overflow/blob/main/CVE-Report-WAVLINK-WN535M1-RCE.pdf"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-17T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-17T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-17T06:54:18.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-74843",
"datePublished": "2026-08-17T11:15:08.412Z",
"dateReserved": "2026-08-17T04:49:13.431Z",
"dateUpdated": "2026-08-17T14:44:57.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18607 (GCVE-0-2026-18607)
Vulnerability from cvelistv5 – Published: 2026-08-03 16:45 – Updated: 2026-08-03 20:23
VLAI
EPSS
VEX
Title
Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow
Summary
A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 20:22 UTC
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385530 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385530/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18607 | third-party-advisory |
| https://vuldb.com/submit/852637 | third-party-advisory |
| https://github.com/0xcc12138/WAVLINK-vul | exploit |
Impacted products
12 products
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WN572 |
Affected:
20260609
cpe:2.3:a:wavlink:wn572:*:*:*:*:*:*:*:* |
|
| Wavlink | WN570H |
Affected:
20260609
cpe:2.3:a:wavlink:wn570h:*:*:*:*:*:*:*:* |
|
| Wavlink | WN573 |
Affected:
20260609
cpe:2.3:a:wavlink:wn573:*:*:*:*:*:*:*:* |
|
| Wavlink | WN529 |
Affected:
20260609
cpe:2.3:a:wavlink:wn529:*:*:*:*:*:*:*:* |
|
| Wavlink | WN530 |
Affected:
20260609
cpe:2.3:a:wavlink:wn530:*:*:*:*:*:*:*:* |
|
| Wavlink | WN531 |
Affected:
20260609
cpe:2.3:a:wavlink:wn531:*:*:*:*:*:*:*:* |
|
| Wavlink | WN535 |
Affected:
20260609
cpe:2.3:a:wavlink:wn535:*:*:*:*:*:*:*:* |
|
| Wavlink | etc. WN529 |
Affected:
20260609
cpe:2.3:a:wavlink:etc._wn529:*:*:*:*:*:*:*:* |
|
| Wavlink | WN536 |
Affected:
20260609
cpe:2.3:a:wavlink:wn536:*:*:*:*:*:*:*:* |
|
| Wavlink | WN551 |
Affected:
20260609
cpe:2.3:a:wavlink:wn551:*:*:*:*:*:*:*:* |
|
| Wavlink | WN557 |
Affected:
20260609
cpe:2.3:a:wavlink:wn557:*:*:*:*:*:*:*:* |
|
| Wavlink | NU516 |
Affected:
20260609
cpe:2.3:a:wavlink:nu516:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18607",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T20:22:57.235846Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T20:23:24.093Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:wavlink:wn572:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN572",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn570h:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN570H",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn573:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN573",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn529:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN529",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn530:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN530",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn531:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN531",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn535:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN535",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:etc._wn529:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "etc. WN529",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn530:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN530",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn531:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN531",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn535:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN535",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn536:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN536",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn551:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN551",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:wn557:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "WN557",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
},
{
"cpes": [
"cpe:2.3:a:wavlink:nu516:*:*:*:*:*:*:*:*"
],
"modules": [
"lighttpd"
],
"product": "NU516",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "20260609"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "0xcc12138 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation of the argument HTTP_COOKIE leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T16:45:09.268Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385530 | Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385530"
},
{
"name": "VDB-385530 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385530/cti"
},
{
"name": "CVE-2026-18607 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18607"
},
{
"name": "Submit #852637 | WAVLINK Multiple Router Series (WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc.) WN529, WN530, WN531, WN535, WN536, WN551, WN557, NU516,and so on Stack-based Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/852637"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/0xcc12138/WAVLINK-vul"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-03T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-03T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-03T09:22:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18607",
"datePublished": "2026-08-03T16:45:09.268Z",
"dateReserved": "2026-08-03T07:17:39.882Z",
"dateUpdated": "2026-08-03T20:23:24.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18590 (GCVE-0-2026-18590)
Vulnerability from cvelistv5 – Published: 2026-08-03 06:45 – Updated: 2026-08-03 15:37
VLAI
EPSS
VEX
Title
Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection
Summary
A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 13:47 UTC
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385418 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385418/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18590 | third-party-advisory |
| https://vuldb.com/submit/850527 | third-party-advisory |
| https://vuldb.com/submit/850560 | third-party-advisory |
| https://github.com/oduoke567/WAVLINK-NU516U1-2026… | broken-link |
| https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U… | broken-linkpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WL-NU516U1 |
Affected:
708c073-mt7628
cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T13:47:31.761282Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:37:14.370Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"Admin Password Handler"
],
"product": "WL-NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "708c073-mt7628"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "oduoke (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T06:45:10.041Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385418 | Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385418"
},
{
"name": "VDB-385418 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385418/cti"
},
{
"name": "CVE-2026-18590 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18590"
},
{
"name": "Submit #850527 | WAVLINK NU516U1 2026-05-15 (build 708c073-mt7628) Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/850527"
},
{
"name": "Submit #850560 | WAVLINK NU516U1 2026-05-15 (build 708c073-mt7628) Command Injection (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/850560"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/oduoke567/WAVLINK-NU516U1-2026-05-1/blob/main/report2.md"
},
{
"tags": [
"broken-link",
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-02T22:39:06.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18590",
"datePublished": "2026-08-03T06:45:10.041Z",
"dateReserved": "2026-08-02T20:33:59.442Z",
"dateUpdated": "2026-08-03T15:37:14.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18589 (GCVE-0-2026-18589)
Vulnerability from cvelistv5 – Published: 2026-08-03 06:30 – Updated: 2026-08-03 19:59
VLAI
EPSS
VEX
Title
Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow
Summary
A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
9.8 (Critical)
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 19:59 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385417 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385417/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18589 | third-party-advisory |
| https://vuldb.com/submit/850501 | third-party-advisory |
| https://github.com/oduoke567/WAVLINK-NU516U1-2026… | broken-link |
| https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U… | broken-linkpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WL-NU516U1 |
Affected:
708c073-mt7628
cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18589",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T19:59:34.049827Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T19:59:44.346Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:*"
],
"product": "WL-NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "708c073-mt7628"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "oduoke (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T06:30:10.498Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385417 | Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385417"
},
{
"name": "VDB-385417 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385417/cti"
},
{
"name": "CVE-2026-18589 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18589"
},
{
"name": "Submit #850501 | WAVLINK NU516U1 2026-05-15 (build 708c073-mt7628) Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/850501"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/oduoke567/WAVLINK-NU516U1-2026-05-1/blob/main/report2.md"
},
{
"tags": [
"broken-link",
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-02T22:38:50.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18589",
"datePublished": "2026-08-03T06:30:10.498Z",
"dateReserved": "2026-08-02T20:33:42.866Z",
"dateUpdated": "2026-08-03T19:59:44.346Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18588 (GCVE-0-2026-18588)
Vulnerability from cvelistv5 – Published: 2026-08-03 06:00 – Updated: 2026-08-03 15:03
VLAI
EPSS
VEX
Title
Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow
Summary
A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT_LENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
9.8 (Critical)
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 14:59 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385416 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385416/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18588 | third-party-advisory |
| https://vuldb.com/submit/850500 | third-party-advisory |
| https://github.com/oduoke567/WAVLINK-NU516U1-2026… | broken-link |
| https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U… | broken-linkpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WL-NU516U1 |
Affected:
708c073-mt7628
cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18588",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T14:59:51.052277Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T15:03:20.669Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/850500"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:*"
],
"product": "WL-NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "708c073-mt7628"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "oduoke (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT_LENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 10,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T06:00:11.107Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385416 | Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385416"
},
{
"name": "VDB-385416 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385416/cti"
},
{
"name": "CVE-2026-18588 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18588"
},
{
"name": "Submit #850500 | WAVLINK WL-NU516U1 2026-05-15 (build 708c073-mt7628) Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/850500"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/oduoke567/WAVLINK-NU516U1-2026-05-1/blob/main/report2.md"
},
{
"tags": [
"broken-link",
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-02T22:38:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18588",
"datePublished": "2026-08-03T06:00:11.107Z",
"dateReserved": "2026-08-02T20:33:29.434Z",
"dateUpdated": "2026-08-03T15:03:20.669Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18587 (GCVE-0-2026-18587)
Vulnerability from cvelistv5 – Published: 2026-08-03 05:45 – Updated: 2026-08-03 20:16
VLAI
EPSS
VEX
Title
Wavlink WL-NU516U1 Config Import os command injection
Summary
A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been published and may be used. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-03 20:16 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/385415 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/385415/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-18587 | third-party-advisory |
| https://vuldb.com/submit/850494 | third-party-advisory |
| https://github.com/oduoke567/WAVLINK-NU516U1-2026… | broken-link |
| https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U… | broken-linkpatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WL-NU516U1 |
Affected:
708c073-mt7628
cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18587",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-03T20:16:13.207043Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T20:16:37.670Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vuldb.com/submit/850494"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:*"
],
"modules": [
"Config Import"
],
"product": "WL-NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "708c073-mt7628"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "oduoke (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been published and may be used. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.6,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T05:45:11.360Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-385415 | Wavlink WL-NU516U1 Config Import os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/385415"
},
{
"name": "VDB-385415 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/385415/cti"
},
{
"name": "CVE-2026-18587 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-18587"
},
{
"name": "Submit #850494 | WAVLINK WL-NU516U1 2026-05-15 (build 708c073-mt7628) Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/850494"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/oduoke567/WAVLINK-NU516U1-2026-05-1/blob/main/report.md"
},
{
"tags": [
"broken-link",
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-02T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-02T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-02T22:38:32.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WL-NU516U1 Config Import os command injection",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-18587",
"datePublished": "2026-08-03T05:45:11.360Z",
"dateReserved": "2026-08-02T20:33:24.850Z",
"dateUpdated": "2026-08-03T20:16:37.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15513 (GCVE-0-2026-15513)
Vulnerability from cvelistv5 – Published: 2026-07-12 23:30 – Updated: 2026-07-13 15:24
VLAI
EPSS
VEX
Title
Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection
Summary
A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lan_ip results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-13 15:24 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/377842 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/377842/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-15513 | third-party-advisory |
| https://vuldb.com/submit/847517 | third-party-advisory |
| https://github.com/0xcc12138/wavlink-nu516u1-csrf… | exploit |
| https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WL-NU516U1 |
Affected:
260515
cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15513",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T15:24:03.623706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-13T15:24:17.623Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:*"
],
"product": "WL-NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "260515"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "0xcc12138 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lan_ip results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-12T23:30:15.048Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-377842 | Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/377842"
},
{
"name": "VDB-377842 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/377842/cti"
},
{
"name": "CVE-2026-15513 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-15513"
},
{
"name": "Submit #847517 | WAVLINK NU516U1 M16U1_V260515 OS Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/847517"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/0xcc12138/wavlink-nu516u1-csrf-command-injection-"
},
{
"tags": [
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-07-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-07-12T08:31:31.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-15513",
"datePublished": "2026-07-12T23:30:15.048Z",
"dateReserved": "2026-07-12T06:26:27.054Z",
"dateUpdated": "2026-07-13T15:24:17.623Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13539 (GCVE-0-2026-13539)
Vulnerability from cvelistv5 – Published: 2026-06-29 05:30 – Updated: 2026-06-29 14:52
VLAI
EPSS
VEX
Title
Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_407504 stack-based overflow
Summary
A vulnerability was identified in Wavlink WL-NU516U1-A M16U1_V240425. The impacted element is the function sub_407504 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. Such manipulation of the argument Guest_ssid leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-29 14:13 UTC
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/374547 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/374547/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-13539 | third-party-advisory |
| https://vuldb.com/submit/834024 | third-party-advisory |
| https://github.com/Svigo-o/Wavlink_vul/tree/main/… | exploit |
| https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WL-NU516U1-A |
Affected:
M16U1_V240425
cpe:2.3:a:wavlink:wl-nu516u1-a:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13539",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-29T14:13:41.239265Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T14:52:41.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:wavlink:wl-nu516u1-a:*:*:*:*:*:*:*:*"
],
"modules": [
"POST Parameter Handler"
],
"product": "WL-NU516U1-A",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "M16U1_V240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "JuneGu (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Wavlink WL-NU516U1-A M16U1_V240425. The impacted element is the function sub_407504 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. Such manipulation of the argument Guest_ssid leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 9,
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "Memory Corruption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T05:30:09.451Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-374547 | Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_407504 stack-based overflow",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/374547"
},
{
"name": "VDB-374547 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/374547/cti"
},
{
"name": "CVE-2026-13539 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-13539"
},
{
"name": "Submit #834024 | Wavlink WL-NU516U1-A M16U1_V240425 Buffer Overflow",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834024"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Svigo-o/Wavlink_vul/tree/main/wavlink-wl-nu516u1-wireless-guestwifi-guestssid-buffer-overflow"
},
{
"tags": [
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-28T12:07:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_407504 stack-based overflow"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-13539",
"datePublished": "2026-06-29T05:30:09.451Z",
"dateReserved": "2026-06-28T10:01:38.197Z",
"dateUpdated": "2026-06-29T14:52:41.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13538 (GCVE-0-2026-13538)
Vulnerability from cvelistv5 – Published: 2026-06-29 05:15 – Updated: 2026-06-29 13:48
VLAI
EPSS
VEX
Title
Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection
Summary
A vulnerability was determined in Wavlink WL-NU516U1-A M16U1_V240425. The affected element is the function sub_401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-29 13:47 UTC
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/374546 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/374546/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-13538 | third-party-advisory |
| https://vuldb.com/submit/834019 | third-party-advisory |
| https://vuldb.com/submit/834021 | third-party-advisory |
| https://vuldb.com/submit/834022 | third-party-advisory |
| https://vuldb.com/submit/834023 | third-party-advisory |
| https://github.com/Svigo-o/Wavlink_vul/tree/main/… | related |
| https://github.com/Svigo-o/Wavlink_vul/tree/main/… | exploit |
| https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wavlink | WL-NU516U1-A |
Affected:
M16U1_V240425
cpe:2.3:a:wavlink:wl-nu516u1-a:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13538",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-29T13:47:32.393217Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T13:48:00.057Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:wavlink:wl-nu516u1-a:*:*:*:*:*:*:*:*"
],
"modules": [
"POST Parameter Handler"
],
"product": "WL-NU516U1-A",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "M16U1_V240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "HustBinary (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in Wavlink WL-NU516U1-A M16U1_V240425. The affected element is the function sub_401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-29T05:15:13.662Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-374546 | Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/374546"
},
{
"name": "VDB-374546 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/374546/cti"
},
{
"name": "CVE-2026-13538 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-13538"
},
{
"name": "Submit #834019 | Wavlink WL-NU516U1-A M16U1_V240425 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834019"
},
{
"name": "Submit #834021 | Wavlink WL-NU516U1-A M16U1_V240425 Command Injection (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834021"
},
{
"name": "Submit #834022 | Wavlink WL-NU516U1-A M16U1_V240425 Command Injection (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834022"
},
{
"name": "Submit #834023 | Wavlink WL-NU516U1-A M16U1_V240425 Command Injection (Duplicate)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/834023"
},
{
"tags": [
"related"
],
"url": "https://github.com/Svigo-o/Wavlink_vul/tree/main/wavlink-wl-nu516u1-wireless-multissid-ssid2g2-command-injection"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/Svigo-o/Wavlink_vul/tree/main/wavlink-wl-nu516u1-wireless-multissid-ssid5g2-command-injection"
},
{
"tags": [
"patch"
],
"url": "https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-28T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-28T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-28T12:06:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-13538",
"datePublished": "2026-06-29T05:15:13.662Z",
"dateReserved": "2026-06-28T10:01:35.649Z",
"dateUpdated": "2026-06-29T13:48:00.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8230 (GCVE-0-2026-8230)
Vulnerability from cvelistv5 – Published: 2026-05-10 04:30 – Updated: 2026-05-11 14:53
VLAI
EPSS
VEX
Title
Wavlink NU516U1 login.cgi sys_login1 os command injection
Summary
A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 14:53 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/362447 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/362447/cti | signaturepermissions-required |
| https://vuldb.com/submit/800735 | third-party-advisory |
| https://github.com/wudipjq/my_vuln/blob/main/Wavl… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8230",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T14:53:00.917278Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T14:53:10.116Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ziyue Xie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-10T04:30:09.029Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-362447 | Wavlink NU516U1 login.cgi sys_login1 os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/362447"
},
{
"name": "VDB-362447 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/362447/cti"
},
{
"name": "Submit #800735 | Wavlink NU516U1 M16U1_V240425 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/800735"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_9/9.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-09T10:00:11.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink NU516U1 login.cgi sys_login1 os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8230",
"datePublished": "2026-05-10T04:30:09.029Z",
"dateReserved": "2026-05-09T07:54:57.297Z",
"dateUpdated": "2026-05-11T14:53:10.116Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8229 (GCVE-0-2026-8229)
Vulnerability from cvelistv5 – Published: 2026-05-10 04:15 – Updated: 2026-05-11 15:00
VLAI
EPSS
VEX
Title
Wavlink NU516U1 wireless.cgi WifiBasic os command injection
Summary
A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument AuthMethod/EncrypType results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 15:00 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/362446 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/362446/cti | signaturepermissions-required |
| https://vuldb.com/submit/800734 | third-party-advisory |
| https://github.com/wudipjq/my_vuln/blob/main/Wavl… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8229",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T15:00:14.128075Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T15:00:57.887Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ziyue Xie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument AuthMethod/EncrypType results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-10T04:15:09.652Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-362446 | Wavlink NU516U1 wireless.cgi WifiBasic os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/362446"
},
{
"name": "VDB-362446 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/362446/cti"
},
{
"name": "Submit #800734 | Wavlink NU516U1 M16U1_V240425 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/800734"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_8/8.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-09T10:00:08.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink NU516U1 wireless.cgi WifiBasic os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8229",
"datePublished": "2026-05-10T04:15:09.652Z",
"dateReserved": "2026-05-09T07:54:54.467Z",
"dateUpdated": "2026-05-11T15:00:57.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8228 (GCVE-0-2026-8228)
Vulnerability from cvelistv5 – Published: 2026-05-10 04:00 – Updated: 2026-05-12 02:33
VLAI
EPSS
VEX
Title
Wavlink NU516U1 wireless.cgi advance os command injection
Summary
A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlan_conf/Channel/skiplist/ieee_80211h leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-12 02:33 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/362445 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/362445/cti | signaturepermissions-required |
| https://vuldb.com/submit/800733 | third-party-advisory |
| https://github.com/wudipjq/my_vuln/blob/main/Wavl… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8228",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T02:33:06.220143Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T02:33:15.334Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ziyue Xie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlan_conf/Channel/skiplist/ieee_80211h leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-10T04:00:08.818Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-362445 | Wavlink NU516U1 wireless.cgi advance os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/362445"
},
{
"name": "VDB-362445 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/362445/cti"
},
{
"name": "Submit #800733 | Wavlink NU516U1 M16U1_V240425 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/800733"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_7/7.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-09T10:00:05.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink NU516U1 wireless.cgi advance os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8228",
"datePublished": "2026-05-10T04:00:08.818Z",
"dateReserved": "2026-05-09T07:54:51.721Z",
"dateUpdated": "2026-05-12T02:33:15.334Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8227 (GCVE-0-2026-8227)
Vulnerability from cvelistv5 – Published: 2026-05-10 03:45 – Updated: 2026-05-11 17:03
VLAI
EPSS
VEX
Title
Wavlink NU516U1 adm.cgi wzdapMesh os command injection
Summary
A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 17:02 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/362444 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/362444/cti | signaturepermissions-required |
| https://vuldb.com/submit/800732 | third-party-advisory |
| https://github.com/wudipjq/my_vuln/blob/main/Wavl… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8227",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T17:02:59.962404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T17:03:20.576Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ziyue Xie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-10T03:45:08.687Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-362444 | Wavlink NU516U1 adm.cgi wzdapMesh os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/362444"
},
{
"name": "VDB-362444 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/362444/cti"
},
{
"name": "Submit #800732 | Wavlink NU516U1 M16U1_V240425 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/800732"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_6/6.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-09T10:00:02.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink NU516U1 adm.cgi wzdapMesh os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8227",
"datePublished": "2026-05-10T03:45:08.687Z",
"dateReserved": "2026-05-09T07:54:49.022Z",
"dateUpdated": "2026-05-11T17:03:20.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8192 (GCVE-0-2026-8192)
Vulnerability from cvelistv5 – Published: 2026-05-09 18:30 – Updated: 2026-05-11 15:11
VLAI
EPSS
VEX
Title
Wavlink NU516U1 adm.cgi wzdap os command injection
Summary
A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. This vulnerability affects the function wzdap of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument EncrypType/wl_Pass is directly passed by the attacker/so we can control the EncrypType/wl_Pass results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 15:11 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/362344 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/362344/cti | signaturepermissions-required |
| https://vuldb.com/submit/800731 | third-party-advisory |
| https://github.com/wudipjq/my_vuln/blob/main/Wavl… | exploit |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8192",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T15:11:11.582649Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T15:11:41.012Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NU516U1",
"vendor": "Wavlink",
"versions": [
{
"status": "affected",
"version": "M16U1_V240425"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Ziyue Xie (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. This vulnerability affects the function wzdap of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument EncrypType/wl_Pass is directly passed by the attacker/so we can control the EncrypType/wl_Pass results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 6.5,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-09T18:30:11.631Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-362344 | Wavlink NU516U1 adm.cgi wzdap os command injection",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/362344"
},
{
"name": "VDB-362344 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/362344/cti"
},
{
"name": "Submit #800731 | Wavlink NU516U1 M16U1_V240425 Command Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/800731"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_5/5.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-05-08T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-05-08T21:57:28.000Z",
"value": "VulDB entry last update"
}
],
"title": "Wavlink NU516U1 adm.cgi wzdap os command injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-8192",
"datePublished": "2026-05-09T18:30:11.631Z",
"dateReserved": "2026-05-08T19:52:14.500Z",
"dateUpdated": "2026-05-11T15:11:41.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}