CVE-2026-8189

2.1 lowEPSS 7.8%

Low (2.1) in wavlink wl-nu516u1 firmware. EPSS 7.8% chance of exploitation in the next 30 days.

A vulnerability was found in Wavlink NU516U1 M16U1_V240425. Affected by this vulnerability is the function wzdrepeater of the file /cgi-bin/adm.cgi. The manipulation of the argument wlan_bssid/sel_Automode/sel_EncrypTyp results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

Severity

CVSS 4.0

2.1 low

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 7.8% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
CWEs: CWE-77, CWE-78
Published: 2026-05-09
Modified: 2026-07-24
Record from: the NVD, synced 2026-10-19

Affected

wavlink:wl-nu516u1_firmware

References

https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_2/2.md
https://vuldb.com/submit/800728
https://vuldb.com/vuln/362341
https://vuldb.com/vuln/362341/cti

Check your stack JSON