CVE-2026-13539
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk37th percentile — higher than 37% of all known CVEs
Summary
A stack-based buffer overflow vulnerability was found in Wavlink WL-NU516U1-A firmware M16U1_V240425 in the sub_407504 function of /cgi-bin/wireless.cgi. Manipulation of the Guest_ssid argument in the POST Parameter Handler allows remote code execution. The exploit is publicly available.
Risk Assessment
An attacker can remotely compromise the device, leading to network integrity and availability breaches. The public exploit increases the risk of rapid exploitation.
Recommendation
Immediately update the Wavlink WL-NU516U1-A firmware to the latest version provided by the vendor. Restrict management interface access to trusted networks only.
Original NVD description (English source)
A vulnerability was identified in Wavlink WL-NU516U1-A M16U1_V240425. The impacted element is the function sub_407504 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. Such manipulation of the argument Guest_ssid leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.