This vulnerability affects Wavlink NU516U1 firmware version 240425. The sys_login1 function in the CGI login script improperly handles the ipaddr argument, enabling an attacker to inject OS commands remotely. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability. The vendor was notified early, but no patch or official remediation details are currently available. Exploit code has been published, increasing the risk of potential attacks.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to unauthorized control or disruption of the device. The impact on confidentiality, integrity, and availability is rated as low to limited. There is no confirmed exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the device's management interface to trusted sources only and monitor for suspicious activity related to the login.cgi endpoint. Avoid exposing the device directly to untrusted networks.