VulnerabilityAnalyzed

CVE-2026-8188

A vulnerability has been found in Wavlink NU516U1 M16U1_V240425.

LOW 2.1EPSS 5.45%

Does this matter?

Lower severity and a low EPSS score (5.45%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. Affected is the function change_wifi_password of the file /cgi-bin/adm.cgi. The manipulation of the argument wl_channel/wl_Pass/EncrypType leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0: 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 5.45% probability · 92th percentile
CISA KEV: Not listed
Weakness: CWE-77, CWE-78
Affected: wavlink/wl-nu516u1 firmware
Source: cna@vuldb.com

References

https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_1/1.mdExploit, Third Party Advisory
https://vuldb.com/submit/800727Third Party Advisory, VDB Entry
https://vuldb.com/vuln/362340Third Party Advisory, VDB Entry
https://vuldb.com/vuln/362340/ctiPermissions Required, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.