This vulnerability exists in the Wavlink NU516U1 firmware version 240425 within the WifiBasic function of the /cgi-bin/wireless.cgi file. An attacker can remotely exploit this by manipulating the AuthMethod or EncrypType parameters, resulting in OS command injection. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. The vendor was notified early, but no patch or official fix has been published yet. The exploit is publicly available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially compromising device integrity and confidentiality. The impact is rated medium due to limited scope and complexity, but the availability of a public exploit increases risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the device's management interface from untrusted networks and monitor for suspicious activity related to the vulnerable parameters. Avoid exposing the device's web interface to the internet.