PT-2026-39453 · Wavlink · Nu516U1

Ziyue Xie · Published 2026-05-10 · Updated 2026-05-10 · CVE-2026-8227

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wavlink NU516U1 version 240425

Description A weakness in the wzdapMesh() function within the '/cgi-bin/adm.cgi' endpoint allows for remote OS command injection. This occurs when the system fails to properly sanitize input, enabling an attacker to execute arbitrary operating system commands on the device.

Recommendations As a temporary workaround, restrict access to the '/cgi-bin/adm.cgi' endpoint or disable the wzdapMesh() function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-8227

Affected Products

Nu516U1

References · 8

• 🔥 https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_6/6.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8227 · Security Note
• https://vuldb.com/vuln/362444 · Note
• https://vuldb.com/vuln/362444/cti · Note
• https://twitter.com/CVEnew/status/2053537491739918409 · Twitter Post
• https://vuldb.com/submit/800732 · Note
• https://t.me/CVEtracker/53278 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2053382867741254137 · Twitter Post