CVE-2025-10958
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk94th percentile - higher than 94% of all known CVEs
Summary
A flaw was found in Wavlink NU516U1 (M16U1_V240425) in the function sub_403010 of /cgi-bin/wireless.cgi, in the AddMac Page component. Manipulation of the macAddr argument leads to command injection. The vulnerability can be exploited remotely and the exploit has been publicly disclosed.
Risk Assessment
A network-based attacker can remotely execute arbitrary commands on the device, potentially leading to full compromise of the router and the network. The vendor did not respond to the disclosure, so a fix may not be available.
Recommendation
If possible, update the device firmware to a version containing a fix or isolate the administrative interface from untrusted networks. If the vendor remains unresponsive, consider replacing the device with a supported model.
Other vulnerabilities in Wavlink NU516U1
See all- CVE-2026-8230Medium
An OS command injection vulnerability was found in Wavlink NU516U1 240425 in the sys_login1 function of /cgi-bin/login.cgi. Manipulating the ipaddr argument allows remote command execution. The exploit has been published.
- CVE-2026-8229Medium
An OS command injection vulnerability was detected in Wavlink NU516U1 240425 in the WifiBasic function of /cgi-bin/wireless.cgi. Manipulating arguments AuthMethod/EncrypType allows remote command execution. The exploit is publicly available.
- CVE-2026-8228Medium
A security vulnerability has been detected in Wavlink NU516U1 240425. The function advance in the file /cgi-bin/wireless.cgi is affected by OS command injection via manipulation of arguments wlan_conf, Channel, skiplist, or ieee_80211h. The attack can be launched remotely and the exploit has been disclosed.
- CVE-2026-8227Medium
An OS command injection vulnerability was identified in Wavlink NU516U1 240425 in the wzdapMesh function of /cgi-bin/adm.cgi. The attack can be performed remotely. The exploit has been made public.
- CVE-2026-8192Medium
An OS command injection vulnerability was found in Wavlink NU516U1 M16U1_V240425 in the wzdap function of /cgi-bin/adm.cgi. Manipulating arguments EncrypType/wl_Pass allows remote command execution. The exploit has been published.
- CVE-2026-8191Medium
An OS command injection vulnerability was identified in Wavlink NU516U1 M16U1_V240425 in the wifi_region function of /cgi-bin/adm.cgi. Manipulating arguments skiplist1/skiplist2 allows remote command execution. The exploit is publicly available.
- CVE-2026-8190Medium
An OS command injection vulnerability was found in Wavlink NU516U1 M16U1_V240425 in the wan function of /cgi-bin/adm.cgi. Manipulating arguments ppp_username, ppp_passwd, rwan_ip, rwan_mask, rwan_gateway allows remote command execution. The exploit has been disclosed.
- CVE-2026-8189Medium
A vulnerability was found in Wavlink NU516U1 M16U1_V240425. The function wzdrepeater in the file /cgi-bin/adm.cgi is affected by OS command injection via manipulation of arguments wlan_bssid, sel_Automode, or sel_EncrypTyp. The attack can be launched remotely and the exploit has been made public.
- CVE-2026-8188Medium
An OS command injection vulnerability was found in Wavlink NU516U1 M16U1_V240425 in the change_wifi_password function of /cgi-bin/adm.cgi. Manipulating arguments wl_channel, wl_Pass, EncrypType allows remote command execution. The exploit has been disclosed.
- CVE-2025-10964Medium
A weakness has been identified in Wavlink NU516U1. Affected by this vulnerability is the function sub_401B30 of the file /cgi-bin/firewall.cgi. This manipulation of the argument remoteManagementEnabled causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
A flaw has been found in Wavlink NU516U1 M16U1_V240425. Impacted is the function sub_403010 of the file /cgi-bin/wireless.cgi of the component AddMac Page. This manipulation of the argument macAddr causes command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS