Wavlink Router Firmware Upgrade Remote Command Injection

Summary

A vulnerability in the Wavlink WL-NU516U1's firmware upgrade feature allows an attacker to execute unauthorized commands on the router, potentially allowing them to access or change settings. This can happen if a user clicks on a malicious link or visits a compromised website. Upgrade to the latest firmware version as soon as possible to fix this issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
wavlink	wl-nu516u1_firmware	m16u1_v240425	–

Original title

A vulnerability was determined in Wavlink WL-NU516U1 V240425. This affects the function sub_405AF4 of the file /cgi-bin/adm.cgi of the component OTA Online Upgrade. This manipulation of the argumen...

Original description

A vulnerability was determined in Wavlink WL-NU516U1 V240425. This affects the function sub_405AF4 of the file /cgi-bin/adm.cgi of the component OTA Online Upgrade. This manipulation of the argument firmware_url causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

nvd CVSS2.0 8.3

nvd CVSS3.1 7.2

nvd CVSS4.0 7.3

Vulnerability type

CWE-74 Injection

CWE-77 Command Injection