CVE-2026-8228
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
A security vulnerability has been detected in Wavlink NU516U1 240425. The function advance in the file /cgi-bin/wireless.cgi is affected by OS command injection via manipulation of arguments wlan_conf, Channel, skiplist, or ieee_80211h. The attack can be launched remotely and the exploit has been disclosed.
Risk Assessment
A remote attacker could gain full control over the device, potentially leading to network compromise, data theft, or use of the device in a botnet.
Recommendation
Immediately update the device firmware to the latest version if a patch is available. Otherwise, consider decommissioning the device.
Original NVD description (English source)
A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlan_conf/Channel/skiplist/ieee_80211h leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.