VulnerabilityAnalyzed

CVE-2026-8228

A security vulnerability has been detected in Wavlink NU516U1 240425.

LOW 2.1EPSS 4.81%

Does this matter?

Lower severity and a low EPSS score (4.81%). Track it; it rarely justifies an emergency change on its own.

Description

A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlan_conf/Channel/skiplist/ieee_80211h leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0: 2.1 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 4.81% probability · 91th percentile
CISA KEV: Not listed
Weakness: CWE-77, CWE-78
Affected: wavlink/wl-nu516u1 firmware
Source: cna@vuldb.com

References

https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_7/7.mdExploit, Third Party Advisory
https://vuldb.com/submit/800733Third Party Advisory, VDB Entry
https://vuldb.com/vuln/362445Third Party Advisory, VDB Entry
https://vuldb.com/vuln/362445/ctiPermissions Required, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.