How severe is CVE-2026-8191?

CVE-2026-8191 has a CVSS 2.0 base score of 6.5 (MEDIUM). EPSS estimates a 8.5% probability of exploitation in the next 30 days.

CVE-2026-8191: Wavlink NU516U1 adm.cgi wifi

Description

A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-bin/adm.cgi. Such manipulation of the argument skiplist1/skiplist2 leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Severity

CVSS 4.0 · CNA5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1 · CNA6.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

CVSS 3.0 · CNA6.3 MEDIUM

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

CVSS 2.0 · CNA6.5 MEDIUM

AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

SSVC · CISA-ADP

Exploitationpoc

Automatableno

Technical impactpartial

Affected Products

Vendor	Product	Affected versions
Wavlink	NU516U1	M16U1_V240425

References

4 Links

Exploits & PoCs

https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_4/4.md

Third-party advisories

Submit #800730 | Wavlink NU516U1 M16U1_V240425 Command Injection

Technical writeups

VDB-362343 | Wavlink NU516U1 adm.cgi wifi_region os command injection

Detection signatures

VDB-362343 | CTI Indicators (IOB, IOC, TTP, IOA)

Record Details

Published

2026-05-09

Last updated

2026-05-12

Assigner (CNA)

VulDB

Credited to

Ziyue Xie (VulDB User); VulDB CNA Team

More from Wavlink

CVE-2026-36625.8

Wavlink WL-NU516U1 adm.cgi usb_p910 command injection

CVE-2026-36615.8

Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection

CVE-2026-36128.6

Wavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub_405AF4 command injection

CVE-2026-25276.5

Wavlink WL-WN579A3 login.cgi command injection

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-78 · OS Command Injection

Application Security Tools Penetration Testing Tools

CWE-77 · Command Injection

Application Security Tools Penetration Testing Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.