CVE-2026-8189
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
A vulnerability was found in Wavlink NU516U1 M16U1_V240425. The function wzdrepeater in the file /cgi-bin/adm.cgi is affected by OS command injection via manipulation of arguments wlan_bssid, sel_Automode, or sel_EncrypTyp. The attack can be launched remotely and the exploit has been made public.
Risk Assessment
A remote attacker could execute arbitrary system commands on the device, potentially leading to full compromise of the device and network.
Recommendation
Immediately update the device firmware to the latest version if a patch is available. Otherwise, consider decommissioning the device.
Original NVD description (English source)
A vulnerability was found in Wavlink NU516U1 M16U1_V240425. Affected by this vulnerability is the function wzdrepeater of the file /cgi-bin/adm.cgi. The manipulation of the argument wlan_bssid/sel_Automode/sel_EncrypTyp results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.