CVE-2026-8227
Wavlink NU516U1 OS Command Injection Vulnerability
Publication date: 2026-05-10
Last updated on: 2026-05-10
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wavlink | nu516u1 | 240425 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-8227 is a Remote Command Execution (RCE) vulnerability in the Wavlink NU516U1 device, specifically in the wzdapMesh function of the /cgi-bin/adm.cgi file.
The vulnerability occurs because certain parameters (ppp_username, ppp_passwd, rwan_ip, rwan_mask, and rwan_gateway) are passed directly without proper sanitization, allowing an attacker to inject malicious OS commands.
For example, an attacker can set ppp_username to a command like $(telnetd -l /bin/sh -p 8893) which opens a telnet service on the device, giving the attacker shell access.
The attack can be performed remotely by sending a crafted HTTP POST request to the vulnerable endpoint.
How can this vulnerability impact me? :
This vulnerability allows an attacker to execute arbitrary commands on the affected device remotely.
By gaining shell access, the attacker can control the device, potentially leading to unauthorized access, data theft, device manipulation, or using the device as a foothold to attack other systems.
Since the exploit is publicly available, the risk of exploitation is higher.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unusual HTTP POST requests to the /cgi-bin/adm.cgi endpoint, specifically targeting the wzdapMesh function with parameters such as ppp_username, ppp_passwd, rwan_ip, rwan_mask, and rwan_gateway.
A crafted HTTP POST request containing command injection payloads in these parameters indicates exploitation attempts.
- Use network monitoring tools or intrusion detection systems (IDS) to look for POST requests to /cgi-bin/adm.cgi with suspicious parameter values.
- Example command to detect such requests in web server logs (assuming logs are stored in access.log):
- grep "/cgi-bin/adm.cgi" access.log | grep -E "ppp_username=|ppp_passwd=|rwan_ip=|rwan_mask=|rwan_gateway="
- Look for suspicious command injection patterns such as $(telnetd -l /bin/sh -p 8893) or other shell command syntax in these parameters.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable /cgi-bin/adm.cgi endpoint to trusted networks only.
Disable or block remote access to the wzdapMesh function if possible.
Monitor and filter incoming HTTP POST requests to prevent malicious parameter injection.
Apply any available patches or firmware updates provided by the vendor to fix the command injection vulnerability.
If patches are not yet available, consider isolating the affected device from untrusted networks to prevent remote exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.