CVE-2026-8191
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
An OS command injection vulnerability was identified in Wavlink NU516U1 M16U1_V240425 in the wifi_region function of /cgi-bin/adm.cgi. Manipulating arguments skiplist1/skiplist2 allows remote command execution. The exploit is publicly available.
Risk Assessment
A remote attacker can take control of the device, potentially leading to network compromise and data breach.
Recommendation
Apply the vendor's patch immediately or disconnect the device from the network until a patch is available.
Original NVD description (English source)
A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-bin/adm.cgi. Such manipulation of the argument skiplist1/skiplist2 leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.