This vulnerability affects Wavlink NU516U1 version 240425. The advance function in the /cgi-bin/wireless.cgi file improperly processes the wlan_conf/Channel/skiplist/ieee_80211h parameter, enabling remote OS command injection. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low attack complexity, no user interaction, and limited privileges required. The vendor was notified early, but no patch or official remediation has been published. The device is not a cloud service, so remediation depends on vendor firmware updates.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to unauthorized control or disruption of device functionality. The impact is limited by the requirement of low privileges and the vulnerability's partial vector and impact metrics, resulting in a medium severity rating. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting remote access to the device's management interfaces and monitor for unusual activity. Avoid exposing the vulnerable interface to untrusted networks. Follow vendor communications for updates on patches or firmware upgrades.