This vulnerability (CVE-2026-8227) in Wavlink NU516U1 version 240425 involves an OS command injection flaw in the wzdapMesh function of the /cgi-bin/adm.cgi file. An attacker can remotely manipulate this function to execute arbitrary operating system commands on the device. The vulnerability is publicly disclosed with exploit code available, but no official patch or remediation level has been announced by Wavlink. The CVSS 4.0 score is 5.3, indicating medium severity with network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to unauthorized control or disruption. The impact is rated medium, reflecting limited but significant risk due to remote exploitability and available public exploit code. No evidence of exploitation in the wild has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the device's management interface to trusted sources only and monitor for unusual activity. Avoid exposing the device's administrative CGI interface to untrusted networks.