CVE-2026-8192: OS Command Injection in Wavlink NU516U1
CVE-2026-8192 is an OS command injection vulnerability in the Wavlink NU516U1 device, specifically affecting version M16U1_V240425. The flaw exists in the wzdap function of /cgi-bin/adm. cgi, where attacker-controlled input in the EncrypType/wl_Pass argument is passed directly to the operating system, enabling remote command execution. The vulnerability has a medium severity with a CVSS score of 5. 3. Although the vendor was contacted early, no official patch or remediation guidance has been provided yet. Public exploit code is available, increasing the risk of exploitation. No known exploits in the wild have been reported so far. Users of the affected version should monitor vendor advisories for updates and exercise caution when exposing the device to untrusted networks.
AI Analysis
Technical Summary
This vulnerability in Wavlink NU516U1 M16U1_V240425 involves an OS command injection via the wzdap function in /cgi-bin/adm.cgi. The attacker can manipulate the EncrypType/wl_Pass parameter, which is directly passed to the operating system without proper sanitization, allowing remote command execution. The vulnerability is remotely exploitable without user interaction and has a medium CVSS 4.0 score of 5.3. The vendor has been notified but has not yet provided a patch or official remediation. Public exploit code has been released, but no active exploitation has been confirmed.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary OS commands remotely on the affected device, potentially leading to unauthorized control or disruption of device functionality. The medium severity reflects the ease of exploitation and the potential impact on device security. No evidence of active exploitation in the wild has been reported to date.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected device's management interface to trusted networks only and consider disabling remote management features if possible. Monitor vendor communications for updates and apply patches promptly once available.
CVE-2026-8192: OS Command Injection in Wavlink NU516U1
Description
CVE-2026-8192 is an OS command injection vulnerability in the Wavlink NU516U1 device, specifically affecting version M16U1_V240425. The flaw exists in the wzdap function of /cgi-bin/adm. cgi, where attacker-controlled input in the EncrypType/wl_Pass argument is passed directly to the operating system, enabling remote command execution. The vulnerability has a medium severity with a CVSS score of 5. 3. Although the vendor was contacted early, no official patch or remediation guidance has been provided yet. Public exploit code is available, increasing the risk of exploitation. No known exploits in the wild have been reported so far. Users of the affected version should monitor vendor advisories for updates and exercise caution when exposing the device to untrusted networks.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Wavlink NU516U1 M16U1_V240425 involves an OS command injection via the wzdap function in /cgi-bin/adm.cgi. The attacker can manipulate the EncrypType/wl_Pass parameter, which is directly passed to the operating system without proper sanitization, allowing remote command execution. The vulnerability is remotely exploitable without user interaction and has a medium CVSS 4.0 score of 5.3. The vendor has been notified but has not yet provided a patch or official remediation. Public exploit code has been released, but no active exploitation has been confirmed.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary OS commands remotely on the affected device, potentially leading to unauthorized control or disruption of device functionality. The medium severity reflects the ease of exploitation and the potential impact on device security. No evidence of active exploitation in the wild has been reported to date.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected device's management interface to trusted networks only and consider disabling remote management features if possible. Monitor vendor communications for updates and apply patches promptly once available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-05-08T19:52:14.500Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69ffe1afcbff5d8610eac9df
Added to database: 5/10/2026, 1:38:55 AM
Last enriched: 5/10/2026, 1:39:09 AM
Last updated: 5/10/2026, 9:08:54 AM
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.