How severe is CVE-2026-3704?

CVE-2026-3704 has a CVSS 2.0 base score of 5.8 (MEDIUM). EPSS estimates a 5.5% probability of exploitation in the next 30 days.

CVE-2026-3704: Wavlink NU516U1 Incomplete Fix CVE-2025-10959

Description

A vulnerability has been found in Wavlink NU516U1 251208. This vulnerability affects the function sub_405B2C of the file /cgi-bin/firewall.cgi of the component Incomplete Fix CVE-2025-10959. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Severity

CVSS 4.0 · CNA5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1 · CNA4.7 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

CVSS 3.0 · CNA4.7 MEDIUM

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

CVSS 2.0 · CNA5.8 MEDIUM

AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C

SSVC · CISA-ADP

Exploitationnone

Automatableno

Technical impactpartial

Affected Products

Vendor	Product	Affected versions
Wavlink	NU516U1	251208

References

6 Links

Patches

https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-02-27-2fcf6ae-mt7628-squashfs-sysupgrade.bin

Exploits & PoCs

https://github.com/Wlz1112/Wavlink-NU516U1-V251208-/blob/main/wavlink_DMZ.md#exp

Third-party advisories

Submit #759233 | Wavlink NU516U1 V251208 Command Injection

Technical writeups

VDB-349650 | Wavlink NU516U1 Incomplete Fix CVE-2025-10959 firewall.cgi sub_405B2C command injection

Detection signatures

VDB-349650 | CTI Indicators (IOB, IOC, TTP, IOA)

Other references

https://github.com/Wlz1112/Wavlink-NU516U1-V251208-/blob/main/wavlink_DMZ.md

Record Details

Published

2026-03-08

Last updated

2026-03-10

Assigner (CNA)

VulDB

Credited to

haimianbaobao (VulDB User); VulDB

More from Wavlink

CVE-2026-36625.8

Wavlink WL-NU516U1 adm.cgi usb_p910 command injection

CVE-2026-36615.8

Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection

CVE-2026-36128.6

Wavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub_405AF4 command injection

CVE-2026-25276.5

Wavlink WL-WN579A3 login.cgi command injection

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-77 · Command Injection

Application Security Tools Penetration Testing Tools

CWE-74 · Injection

Application Security Tools Penetration Testing Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.