Threats tagged 'ghsa-hm76-m6wf-p499'

CVE-2026-8190 is a remote OS command injection vulnerability in the Wavlink NU516U1 M16U1_V240425 device. The flaw exists in the 'wan' function of the /cgi-bin/adm.cgi file, where attacker-controlled input parameters (ppp_username, ppp_passwd, rwan_ip, rwan_mask, rwan_gateway) are passed directly, allowing command injection. The vulnerability has a CVSS score of 6.3 (medium severity) and public exploit code has been disclosed. No patch or fixed version information is currently available.