Wavlink WL-NU516U1 240425 Allows Unwanted Remote Code Execution

Summary

A bug in the Wavlink WL-NU516U1 240425 can be exploited by a remote attacker, allowing them to potentially take control of the device. This could lead to unauthorized access and disruption of the router. Users of this device should update to the latest firmware as soon as possible to fix the issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
wavlink	wl-nu516u1_firmware	m16u1_v240425	–

Original title

A flaw has been found in Wavlink WL-NU516U1 240425. This affects the function ota_new_upgrade of the file /cgi-bin/adm.cgi. This manipulation of the argument model causes command injection. It is p...

Original description

A flaw has been found in Wavlink WL-NU516U1 240425. This affects the function ota_new_upgrade of the file /cgi-bin/adm.cgi. This manipulation of the argument model causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

nvd CVSS2.0 5.8

nvd CVSS3.1 4.7

nvd CVSS4.0 5.1

Vulnerability type

CWE-74 Injection

CWE-77 Command Injection