CVE-2025-10961
MediumCVSS 5.5Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. This affects the function sub_4030C0 of the file /cgi-bin/wireless.cgi of the component Delete_Mac_list Page. Executing manipulation of the argument delete_list can lead to command injection. The vendor was contacted early about this disclosure but did not respond in any way.
Risk Assessment
Possible remote execution of arbitrary commands on the device, which could lead to full compromise of the router and network.
Recommendation
Due to vendor's lack of response, consider decommissioning the device or applying additional network protections (e.g., restricting access to the administrative interface).
Other vulnerabilities in Wavlink NU516U1
See all- CVE-2026-8230Medium
An OS command injection vulnerability was found in Wavlink NU516U1 240425 in the sys_login1 function of /cgi-bin/login.cgi. Manipulating the ipaddr argument allows remote command execution. The exploit has been published.
- CVE-2026-8229Medium
An OS command injection vulnerability was detected in Wavlink NU516U1 240425 in the WifiBasic function of /cgi-bin/wireless.cgi. Manipulating arguments AuthMethod/EncrypType allows remote command execution. The exploit is publicly available.
- CVE-2026-8228Medium
A security vulnerability has been detected in Wavlink NU516U1 240425. The function advance in the file /cgi-bin/wireless.cgi is affected by OS command injection via manipulation of arguments wlan_conf, Channel, skiplist, or ieee_80211h. The attack can be launched remotely and the exploit has been disclosed.
- CVE-2026-8227Medium
An OS command injection vulnerability was identified in Wavlink NU516U1 240425 in the wzdapMesh function of /cgi-bin/adm.cgi. The attack can be performed remotely. The exploit has been made public.
- CVE-2026-8192Medium
An OS command injection vulnerability was found in Wavlink NU516U1 M16U1_V240425 in the wzdap function of /cgi-bin/adm.cgi. Manipulating arguments EncrypType/wl_Pass allows remote command execution. The exploit has been published.
- CVE-2026-8191Medium
An OS command injection vulnerability was identified in Wavlink NU516U1 M16U1_V240425 in the wifi_region function of /cgi-bin/adm.cgi. Manipulating arguments skiplist1/skiplist2 allows remote command execution. The exploit is publicly available.
- CVE-2026-8190Medium
An OS command injection vulnerability was found in Wavlink NU516U1 M16U1_V240425 in the wan function of /cgi-bin/adm.cgi. Manipulating arguments ppp_username, ppp_passwd, rwan_ip, rwan_mask, rwan_gateway allows remote command execution. The exploit has been disclosed.
- CVE-2026-8189Medium
A vulnerability was found in Wavlink NU516U1 M16U1_V240425. The function wzdrepeater in the file /cgi-bin/adm.cgi is affected by OS command injection via manipulation of arguments wlan_bssid, sel_Automode, or sel_EncrypTyp. The attack can be launched remotely and the exploit has been made public.
- CVE-2026-8188Medium
An OS command injection vulnerability was found in Wavlink NU516U1 M16U1_V240425 in the change_wifi_password function of /cgi-bin/adm.cgi. Manipulating arguments wl_channel, wl_Pass, EncrypType allows remote command execution. The exploit has been disclosed.
- CVE-2025-10964Medium
A weakness has been identified in Wavlink NU516U1. Affected by this vulnerability is the function sub_401B30 of the file /cgi-bin/firewall.cgi. This manipulation of the argument remoteManagementEnabled causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. This affects the function sub_4030C0 of the file /cgi-bin/wireless.cgi of the component Delete_Mac_list Page. Executing manipulation of the argument delete_list can lead to command injection. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS