This vulnerability involves an OS command injection in the wifi_region function of the Wavlink NU516U1 device firmware version M16U1_V240425. The injection occurs through manipulation of the skiplist1 or skiplist2 parameters in the /cgi-bin/adm.cgi CGI script. An attacker can remotely exploit this flaw without user interaction or privileges to execute arbitrary OS commands. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). The vendor has been notified but no official fix or mitigation has been disclosed yet. Exploit code is publicly available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to unauthorized control or disruption of device functionality. The vulnerability does not require user interaction or elevated privileges, increasing its risk. However, the CVSS score and available data indicate a medium severity impact. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's management interface to trusted networks only and monitor for any suspicious activity related to the affected CGI endpoint. Avoid exposing the device management interface to untrusted networks.