CVE-2026-8230
OS Command Injection in Wavlink NU516U1
Publication date: 2026-05-10
Last updated on: 2026-05-10
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wavlink | nu516u1 | 240425 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability allows an attacker to remotely execute arbitrary commands on the affected device without authentication. This can lead to full compromise of the device, unauthorized access to sensitive data, disruption of device functionality, and potentially using the device as a foothold to attack other systems on the network.
Can you explain this vulnerability to me?
CVE-2026-8230 is a Remote Command Execution (RCE) vulnerability found in Wavlink NU516U1 devices. It exists in the sys_login1 function of the /cgi-bin/login.cgi file. By manipulating the ipaddr parameter, an attacker can execute arbitrary operating system commands remotely.
The exploit can be triggered without authentication by sending a specially crafted HTTP POST request, for example, setting ipaddr to a command like 'telnetd -l /bin/sh' to gain shell access on the device.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious HTTP POST requests sent to the /cgi-bin/login.cgi endpoint, specifically those manipulating the ipaddr parameter.
A detection command example is to use curl or similar tools to test if the device is vulnerable by sending a crafted request.
- curl -X POST http://<target-ip>/cgi-bin/login.cgi -d "ipaddr=telnetd -l /bin/sh"
If the device responds by granting shell access or behaves unexpectedly, it indicates the presence of the vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated remote command execution on the affected Wavlink device, which could lead to unauthorized access and control over the system.
Such unauthorized access and potential data compromise can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches.
However, the provided information does not specify direct impacts or compliance assessments related to these standards.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-8230 vulnerability, immediate steps include restricting access to the affected device's /cgi-bin/login.cgi endpoint to trusted networks only.
Avoid exposing the device to untrusted or public networks where unauthenticated attackers could exploit the ipaddr parameter for remote command execution.
Monitor network traffic for suspicious POST requests targeting the sys_login1 function, especially those manipulating the ipaddr parameter.
Apply any available vendor patches or firmware updates as soon as they are released.
If patches are not yet available, consider disabling or restricting access to the vulnerable functionality or device until a fix is applied.