OS Command Injection in Wavlink WL-NU516U1

Executive Summary

CVE-2026-15513 is a stored command injection vulnerability in the Wavlink WL-NU516U1 router firmware, specifically in the adm.cgi component.

The vulnerability arises from improper handling of the lan_ip parameter in the wlink_uci_set_value function. An attacker can manipulate this parameter to inject malicious commands.

The attack involves two stages: first, storing a malicious payload via the page=lan handler, which is saved unsanitized in the router's UCI configuration. Later, when the page=openDHCP handler reads this value and uses it in a system call, the payload is executed as a shell command.

The exploit bypasses CSRF protections due to broken SameSite cookie settings and weak Referer validation, allowing remote attackers to execute arbitrary commands on the device.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on the affected router by injecting malicious payloads into the lan_ip parameter.

Because the payload is stored in the router's configuration, the attacker can achieve persistent remote code execution, potentially leading to full system compromise.

An attacker could use this to take control of the device, disrupt network services, intercept or manipulate network traffic, or use the device as a foothold for further attacks within the network.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the affected Wavlink WL-NU516U1 router firmware version WO-A-2026-05-15-708c073 or similar versions are in use, as these contain the vulnerable adm.cgi component.

Detection can also involve inspecting the lan_ip parameter in the router's UCI configuration for suspicious or malformed values that do not conform to legitimate IPv4 formats, as this parameter is exploited for command injection.

Since the exploit involves stored command injection triggered remotely via HTTP requests, monitoring HTTP traffic for unusual POST requests to /cgi-bin/adm.cgi with parameters related to lan_ip may help identify exploitation attempts.

Specific commands to detect the vulnerability are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the affected Wavlink WL-NU516U1 router firmware to the fixed version released by the vendor.

Additional recommended mitigations include validating the lan_ip parameter to ensure it only accepts legitimate IPv4 addresses, replacing unsafe code patterns like sprintf() and system() calls with safer alternatives, and improving CSRF protections by adding SameSite=Strict to session cookies and implementing proper CSRF tokens and origin-based Referer validation.

Until the upgrade is applied, monitoring and restricting access to the router's administrative interface can reduce the risk of remote exploitation.

Useful 0 Not Useful 0

Compliance Impact

The provided context and resources do not include any information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0