PT-2026-39456 · Wavlink · Nu516U1

Ziyue Xie · Published 2026-05-10 · Updated 2026-05-10 · CVE-2026-8230

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wavlink NU516U1 version 240425

Description A flaw in the sys login1() function within the '/cgi-bin/login.cgi' endpoint allows for remote OS command injection. This occurs through the manipulation of the ipaddr argument, which could lead to full system compromise. This issue is under active exploitation.

Recommendations Update Wavlink NU516U1 version 240425 to the latest patched version. As a temporary workaround, restrict access to the '/cgi-bin/login.cgi' endpoint to minimize the risk of exploitation.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-8230

Affected Products

Nu516U1

References · 8

• 🔥 https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_9/9.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8230 · Security Note
• https://twitter.com/CVEnew/status/2053537482738897194 · Twitter Post
• https://t.me/CVEtracker/53281 · Telegram Post
• https://vuldb.com/submit/800735 · Note
• https://twitter.com/NewsNerdie/status/2053385201229717668 · Twitter Post
• https://vuldb.com/vuln/362447/cti · Note
• https://vuldb.com/vuln/362447 · Note