Command Injection in Wavlink WL-NU516U1-A Router

Executive Summary

CVE-2026-13538 is a command injection vulnerability in the Wavlink WL-NU516U1 router firmware version M16U1_V240425. It occurs in the /cgi-bin/wireless.cgi endpoint, specifically in the function sub_401D68 that handles POST parameters like SSID2G2 and SSID5G2. The vulnerability arises because user input is directly concatenated into shell commands without proper sanitization. Although the input filter blocks backtick and pipe characters, it fails to block command substitution syntax such as $(command), allowing attackers to inject and execute arbitrary commands remotely.

An attacker can exploit this by sending a crafted POST request with malicious SSID2G2 or SSID5G2 values, which results in the execution of arbitrary commands on the device. Proof of concept exploits demonstrate that the device can be made to perform outbound HTTP requests to attacker-controlled servers, confirming remote code execution.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on the affected router without proper authorization. This can lead to full system compromise, unauthorized access, and disruption of network services.

• Attackers can run malicious commands remotely on the device.
• Potential for unauthorized access to the router and connected network.
• Possible disruption or denial of service of network functionality.
• Attackers may use the compromised device to launch further attacks or exfiltrate data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unusual POST requests to the /cgi-bin/wireless.cgi endpoint, specifically when the page parameter is set to multi_ssid and includes suspicious values in the SSID2G2 or SSID5G2 parameters.

Detection can involve capturing and analyzing network traffic for POST requests containing command substitution syntax such as $(command) within these parameters, which bypass the input filter.

A possible command to detect exploitation attempts is to use network traffic inspection tools like tcpdump or Wireshark to filter HTTP POST requests to /cgi-bin/wireless.cgi and look for suspicious payloads.

• tcpdump -A -s 0 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep '/cgi-bin/wireless.cgi'
• Use a web proxy or HTTP log analyzer to search POST data for patterns like 'SSID2G2=$(...)' or 'SSID5G2=$(...)' indicating command injection attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the affected Wavlink WL-NU516U1 router firmware to the fixed version released by the vendor.

Until the upgrade can be applied, restrict access to the /cgi-bin/wireless.cgi endpoint by limiting network exposure, such as disabling remote management or applying firewall rules to block unauthorized POST requests.

Monitor network traffic for signs of exploitation attempts and consider disabling or restricting features that accept user input for SSID2G2 and SSID5G2 parameters if possible.

Useful 0 Not Useful 0