Skip to main content
IMMUNITYSEC

CVE-2026-8230

Wavlink NU516U1 login.cgi sys_login1 os command injection

6.5
MEDIUM
CVSS 2.0
EPSS 8.5% · 95th pctCWE-78CWE-77
2026-05-10•Updated 2026-05-11

Description

A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

Severity

CVSS 4.0 · CNA5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1 · CNA6.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS 3.0 · CNA6.3 MEDIUM
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CVSS 2.0 · CNA6.5 MEDIUM
AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
SSVC · CISA-ADP
Exploitationpoc
Automatableno
Technical impactpartial

Affected Products

VendorProductAffected versions
WavlinkNU516U1
240425

References

4 Links

Record Details

Published
2026-05-10
Last updated
2026-05-11
Assigner (CNA)
VulDB
Credited to
Ziyue Xie (VulDB User); VulDB CNA Team

More from Wavlink

CVE-2026-36625.8

Wavlink WL-NU516U1 adm.cgi usb_p910 command injection

CVE-2026-36615.8

Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection

CVE-2026-36128.6

Wavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub_405AF4 command injection

CVE-2026-82296.5

Wavlink NU516U1 wireless.cgi WifiBasic os command injection

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.