Threats tagged 'ghsa-qv2r-5x2x-f9xv'

A command injection vulnerability exists in the Wavlink NU516U1 240425 device in the sys_login1 function of /cgi-bin/login.cgi. Remote attackers can exploit manipulation of the ipaddr argument to execute OS commands. The vulnerability has a CVSS score of 6.3 (medium severity). Exploit code has been published, but no official patch or remediation is currently confirmed.