This vulnerability affects Wavlink NU516U1 firmware version M16U1_V240425. It is caused by insufficient input validation in the wzdrepeater function within /cgi-bin/adm.cgi, where manipulation of the wlan_bssid, sel_Automode, or sel_EncrypTyp parameters leads to OS command injection. The flaw allows remote attackers to execute arbitrary operating system commands without requiring user interaction or elevated privileges. The vulnerability is publicly disclosed with an exploit available, but no vendor patch or official fix has been announced. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary OS commands on the affected device, potentially leading to unauthorized control or disruption of device functionality. However, the impact is rated medium due to the low impact metrics on confidentiality, integrity, and availability as per the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level has been provided by the vendor, users should monitor for vendor updates. Until a fix is available, restricting network access to the device's management interface and disabling remote administration features where possible may reduce exposure.