This vulnerability affects the Wavlink NU516U1 device running firmware M16U1_V240425. It is caused by improper input validation in the wzdrepeater function within /cgi-bin/adm.cgi, which processes the arguments wlan_bssid, sel_Automode, and sel_EncrypTyp. An attacker can remotely manipulate these parameters to perform OS command injection, potentially executing arbitrary commands on the device. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Although the exploit code is publicly available, there is no evidence of active exploitation. The vendor has been contacted but has not released a patch or mitigation instructions.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary OS commands on the affected device without user interaction and with low attack complexity. This could lead to unauthorized control over the device, potentially impacting device integrity and availability. However, the CVSS vector indicates limited impact on confidentiality, integrity, and availability, and no privilege escalation or user interaction is required. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround has been provided by the vendor, users should monitor for updates from Wavlink. Until a patch is available, restricting network access to the device's management interface and disabling remote administration where possible may reduce exposure.