CVE-2026-3662 is a command injection vulnerability identified in the Wavlink WL-NU516U1 wireless device, version 240425. The flaw exists in the usb_p910 function within the /cgi-bin/adm.cgi script, where the Pr_mode parameter is improperly sanitized. This allows an attacker to inject arbitrary OS commands remotely by manipulating this argument. The vulnerability does not require authentication or user interaction, making it easier to exploit remotely over the network. The CVSS 4.0 vector indicates network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:H but likely a typo or misconfiguration as the description states no authentication), no user interaction (UI:N), and low impact on confidentiality, integrity, and availability (VC:L, VI:L, VA:L). Although the CVSS score is moderate (5.1), the ability to execute commands remotely without user interaction poses a significant risk. The vendor was informed early, but no patches have been published yet. No known active exploitation has been reported, but the public disclosure increases the risk of future attacks. This vulnerability could be leveraged to gain unauthorized control over the device, potentially allowing attackers to pivot into internal networks or disrupt device functionality.

The primary impact of this vulnerability is unauthorized remote command execution on affected Wavlink WL-NU516U1 devices. Successful exploitation could allow attackers to execute arbitrary commands with the privileges of the vulnerable service, potentially leading to full device compromise. This could result in disruption of network connectivity, interception or manipulation of network traffic, and use of the device as a foothold for lateral movement within an organization's internal network. Confidentiality, integrity, and availability of network communications could be compromised. Organizations relying on this device for critical network infrastructure may face operational disruptions and increased risk of further compromise. The lack of authentication and user interaction requirements increases the attack surface and ease of exploitation, raising concerns for environments where these devices are exposed to untrusted networks.

1. Immediately restrict access to the management interface of the Wavlink WL-NU516U1 device to trusted networks only, using firewall rules or network segmentation. 2. Disable or restrict the vulnerable usb_p910 functionality if possible until a patch is available. 3. Monitor network traffic and device logs for unusual command execution patterns or unauthorized access attempts. 4. Apply any vendor-provided patches or firmware updates as soon as they are released. 5. If patching is delayed, consider replacing affected devices with alternative hardware not vulnerable to this issue. 6. Employ network intrusion detection systems (NIDS) to detect exploitation attempts targeting the /cgi-bin/adm.cgi endpoint. 7. Conduct regular security assessments and penetration tests focusing on network devices to identify similar vulnerabilities. 8. Maintain an inventory of all Wavlink devices and their firmware versions to ensure timely vulnerability management.