Vulnerability · Published Mar 7, 2026 · Assigned by VulDB
CVE-2026-3661Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection
Medium 4.7
In plain English
A medium-severity command injection in WL-NU516U1 from Wavlink. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 19.7% (higher than 97% of all known vulnerabilities).
Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)19.7%top 2.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw has been found in Wavlink WL-NU516U1 240425. This affects the function ota_new_upgrade of the file /cgi-bin/adm.cgi. This manipulation of the argument model causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Wavlink | WL-NU516U1 | 240425 |
Weakness: CWE-77, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-349550 | Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection vdb-entry, technical-description
- VDB-349550 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #758227 | wavlink WL-NU516U1-A M16U1_V240425 Command Injection third-party-advisory
- https://github.com/jinhao118/cve/blob/main/WAVLINK_1.md exploit