This vulnerability exists in the Wavlink NU516U1 240425 firmware within the WifiBasic function of the /cgi-bin/wireless.cgi script. By manipulating the AuthMethod or EncrypType parameters, an attacker can perform OS command injection remotely. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vendor was contacted early, but no remediation level or patch information is currently available. The vulnerability is publicly disclosed and the exploit is public, but no active exploitation has been confirmed.

Successful exploitation allows a remote attacker to execute arbitrary OS commands on the affected device without authentication. This can lead to unauthorized control over the device, potentially compromising network security or device functionality. The impact is limited to the affected firmware version 240425 of the Wavlink NU516U1 device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's management interface from untrusted networks to reduce exposure. Monitor vendor communications for updates on patches or official mitigations.