Skip to main content
IMMUNITYSEC

CVE-2026-8229

Wavlink NU516U1 wireless.cgi WifiBasic os command injection

6.5
MEDIUM
CVSS 2.0
EPSS 8.5% · 95th pctCWE-78CWE-77
2026-05-10•Updated 2026-05-11

Description

A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument AuthMethod/EncrypType results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

Severity

CVSS 4.0 · CNA5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1 · CNA6.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS 3.0 · CNA6.3 MEDIUM
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS 2.0 · CNA6.5 MEDIUM
AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
SSVC · CISA-ADP
Exploitationpoc
Automatableno
Technical impactpartial

Affected Products

VendorProductAffected versions
WavlinkNU516U1
240425

References

4 Links

Record Details

Published
2026-05-10
Last updated
2026-05-11
Assigner (CNA)
VulDB
Credited to
Ziyue Xie (VulDB User); VulDB CNA Team

More from Wavlink

CVE-2026-36625.8

Wavlink WL-NU516U1 adm.cgi usb_p910 command injection

CVE-2026-36615.8

Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection

CVE-2026-36128.6

Wavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub_405AF4 command injection

CVE-2026-82306.5

Wavlink NU516U1 login.cgi sys_login1 os command injection

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.