This vulnerability in Wavlink NU516U1 version 240425 involves an OS command injection via the sys_login1 function in /cgi-bin/login.cgi. Manipulating the ipaddr argument can lead to execution of arbitrary operating system commands remotely. The vulnerability has been publicly disclosed with an available exploit, but no vendor-provided fix or mitigation has been confirmed. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector, low complexity, and no user interaction required.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to unauthorized control or disruption of device functionality. The medium CVSS score indicates a moderate risk, with the potential for significant impact depending on the attacker's goals and network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor vendor communications for updates. Until a patch is available, restricting network access to the device's management interface and employing network-level protections may reduce exposure.