Skip to main content
IMMUNITYSEC

CVE-2026-8228

Wavlink NU516U1 wireless.cgi advance os command injection

6.5
MEDIUM
CVSS 2.0
EPSS 8.5% · 95th pctCWE-78CWE-77
2026-05-10•Updated 2026-05-12

Description

A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlan_conf/Channel/skiplist/ieee_80211h leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Severity

CVSS 4.0 · CNA5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1 · CNA6.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS 3.0 · CNA6.3 MEDIUM
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS 2.0 · CNA6.5 MEDIUM
AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
SSVC · CISA-ADP
Exploitationpoc
Automatableno
Technical impactpartial

Affected Products

VendorProductAffected versions
WavlinkNU516U1
240425

References

4 Links

Record Details

Published
2026-05-10
Last updated
2026-05-12
Assigner (CNA)
VulDB
Credited to
Ziyue Xie (VulDB User); VulDB CNA Team

More from Wavlink

CVE-2026-36625.8

Wavlink WL-NU516U1 adm.cgi usb_p910 command injection

CVE-2026-36615.8

Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection

CVE-2026-36128.6

Wavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub_405AF4 command injection

CVE-2026-82306.5

Wavlink NU516U1 login.cgi sys_login1 os command injection

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.