CVE-2026-8188
OS Command Injection in Wavlink NU516U1 Router
Publication date: 2026-05-09
Last updated on: 2026-05-09
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wavlink | nu516u1 | v240425 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-8188 is a Remote Command Execution (RCE) vulnerability found in the Wavlink NU516U1 device, specifically in the change_wifi_password function accessed via /cgi-bin/adm.cgi.
The vulnerability occurs because the parameters wl_channel, wl_Pass, and EncrypType are not properly sanitized before being used, allowing an attacker to inject operating system commands.
An attacker can exploit this remotely by sending a crafted POST request with malicious commands embedded in these parameters, which the device then executes, potentially granting the attacker shell access and control over the device.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to gain unauthorized remote control of the affected Wavlink device.
- Execution of arbitrary commands on the device.
- Potential full shell access to the device.
- Compromise of device security and network integrity.
- Possible use of the device as a foothold for further attacks within the network.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious POST requests sent to the endpoint /cgi-bin/adm.cgi, specifically those containing the parameters wl_channel, wl_Pass, or EncrypType with unusual or malicious values.
A practical detection method is to look for POST requests where the wl_channel parameter includes command injection payloads, such as commands to start a telnet daemon.
- Use network monitoring tools or intrusion detection systems (IDS) to filter HTTP POST requests to /cgi-bin/adm.cgi.
- Example command to capture suspicious requests using tcpdump: tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/cgi-bin/adm.cgi'
- Search web server logs for POST requests containing suspicious parameters, e.g., grep 'POST /cgi-bin/adm.cgi' /var/log/httpd/access_log | grep -E 'wl_channel=|wl_Pass=|EncrypType='
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable endpoint /cgi-bin/adm.cgi to trusted users only, such as by implementing IP whitelisting or network segmentation.
Additionally, disabling remote access to the device's administrative interface can prevent exploitation.
If possible, apply any available patches or firmware updates provided by the vendor to fix the command injection vulnerability.
As a temporary workaround, monitor and block suspicious POST requests containing the vulnerable parameters (wl_channel, wl_Pass, EncrypType) with command injection payloads.