A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. (CVE-2026-18590)
A remote OS command injection vulnerability exists in the set_sys_adm function of the adm.cgi file in Wavlink WL-NU516U1 708c073-mt7628. This vulnerability allows an attacker with limited privileges to execute arbitrary OS commands remotely. The vendor has responded promptly and released a fixed version of the affected product. The CVSS 3.1 base score is 6.3, indicating a medium severity level.
AI Analysis
Technical Summary
The Wavlink WL-NU516U1 708c073-mt7628 device contains a vulnerability in the Admin Password Handler component, specifically in the set_sys_adm function of adm.cgi. This flaw allows remote attackers with low privileges to perform OS command injection, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability has been publicly disclosed, but no known exploits in the wild have been reported. The vendor was contacted early and has released a fixed version promptly.
Potential Impact
Successful exploitation could allow an attacker to execute arbitrary operating system commands remotely with limited privileges, potentially leading to partial compromise of confidentiality, integrity, and availability of the device. However, the overall severity is rated as low by the database, and no active exploitation has been observed.
Mitigation Recommendations
A fixed version of the affected product has been released by the vendor. It is recommended to upgrade to the fixed version to remediate this vulnerability. Since the vendor has provided an official fix, applying the update is the primary mitigation step.
A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. (CVE-2026-18590)
Description
A remote OS command injection vulnerability exists in the set_sys_adm function of the adm.cgi file in Wavlink WL-NU516U1 708c073-mt7628. This vulnerability allows an attacker with limited privileges to execute arbitrary OS commands remotely. The vendor has responded promptly and released a fixed version of the affected product. The CVSS 3.1 base score is 6.3, indicating a medium severity level.
CVSS v3.1
Score 6.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Wavlink WL-NU516U1 708c073-mt7628 device contains a vulnerability in the Admin Password Handler component, specifically in the set_sys_adm function of adm.cgi. This flaw allows remote attackers with low privileges to perform OS command injection, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability has been publicly disclosed, but no known exploits in the wild have been reported. The vendor was contacted early and has released a fixed version promptly.
Potential Impact
Successful exploitation could allow an attacker to execute arbitrary operating system commands remotely with limited privileges, potentially leading to partial compromise of confidentiality, integrity, and availability of the device. However, the overall severity is rated as low by the database, and no active exploitation has been observed.
Mitigation Recommendations
A fixed version of the affected product has been released by the vendor. It is recommended to upgrade to the fixed version to remediate this vulnerability. Since the vendor has provided an official fix, applying the update is the primary mitigation step.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-29gr-cg9c-hpx3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18590"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a71067ebf32cb7a34396cc6
Added to database: 08/03/2026, 21:22:06 UTC
Last enriched: 08/03/2026, 21:39:42 UTC
Last updated: 08/04/2026, 02:17:46 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.