The Wavlink NU516U1 device running firmware version M16U1_V240425 contains an OS command injection vulnerability in the wan function of /cgi-bin/adm.cgi. The vulnerability is due to improper handling of the parameters ppp_username, ppp_passwd, rwan_ip, rwan_mask, and rwan_gateway, which are passed directly to an OS command. This allows remote attackers to inject and execute arbitrary OS commands. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor was notified early, but no patch or official remediation has been published as of the data provided.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary operating system commands on the affected device, potentially leading to unauthorized control or disruption of the device. The impact is limited to devices running the specified vulnerable firmware version. There are no known exploits in the wild currently, but public disclosure increases the risk of exploitation attempts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation has been published, users should monitor vendor communications for updates. Until a patch is available, restricting remote access to the device's administrative interface and disabling WAN-side management (if possible) may reduce exposure.