CVE-2026-8189

6.3

Received

Description

A vulnerability was found in Wavlink NU516U1 M16U1_V240425. Affected by this vulnerability is the function wzdrepeater of the file /cgi-bin/adm.cgi. The manipulation of the argument wlan_bssid/sel_Automode/sel_EncrypTyp results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Severity

Score 6.3

Severity MEDIUM

Timeline

Published May 09, 2026

Modified May 09, 2026

References

https://github.com/wudipjq/my_vuln/blob/main/Wavlink/vuln_2/2.md
https://vuldb.com/submit/800728
https://vuldb.com/vuln/362341
https://vuldb.com/vuln/362341/cti