CVE-2026-8188
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
An OS command injection vulnerability was found in Wavlink NU516U1 M16U1_V240425 in the change_wifi_password function of /cgi-bin/adm.cgi. Manipulating arguments wl_channel, wl_Pass, EncrypType allows remote command execution. The exploit has been disclosed.
Risk Assessment
An attacker can remotely take control of the device, risking network security and access to sensitive data.
Recommendation
Contact the vendor immediately for a patch or consider replacing the device with a supported model.
Original NVD description (English source)
A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. Affected is the function change_wifi_password of the file /cgi-bin/adm.cgi. The manipulation of the argument wl_channel/wl_Pass/EncrypType leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.