PT-2026-39401 · Wavlink · Nu516U1

Ziyue Xie · Published 2026-05-09 · Updated 2026-05-09 · CVE-2026-8190

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wavlink NU516U1 version M16U1 V240425

Description An OS command injection flaw exists in the wan() function within the '/cgi-bin/adm.cgi' endpoint. A remote attacker can exploit this by manipulating the ppp username, ppp passwd, rwan ip, rwan mask, and rwan gateway arguments, which are passed directly to the system without proper validation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-8190

Affected Products

Nu516U1

References · 9

• 🔥 https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_3/3.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8190 · Security Note
• https://t.me/CVEtracker/53227 · Telegram Post
• https://t.me/cveNotify/162876 · Telegram Post
• https://twitter.com/CVEnew/status/2053174609680248993 · Twitter Post
• https://vuldb.com/submit/800729 · Note
• https://vuldb.com/vuln/362342/cti · Note
• https://twitter.com/VulmonFeeds/status/2053180580057997404 · Twitter Post
• https://vuldb.com/vuln/362342 · Note