CVE-2026-13539

🗓️ 29 Jun 2026 05:30:09Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 30 Views🌐 WEB

Wavlink WL-NU516U1-A wireless.cgi Guest_ssid overflow enables remote stack overflow; upgrade to fixed version.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-13539	29 Jun 202605:30	–	attackerkb
Circl	CVE-2026-13539	29 Jun 202607:55	–	circl
Cvelist	CVE-2026-13539 Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_407504 stack-based overflow	29 Jun 202605:30	–	cvelist
EUVD	EUVD-2026-40037	29 Jun 202605:30	–	euvd
NVD	CVE-2026-13539	29 Jun 202607:16	–	nvd
Positive Technologies	PT-2026-53214	28 Jun 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-13539 Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_407504 stack-based overflow	29 Jun 202605:30	–	vulnrichment

[
  {
    "vendor": "Wavlink",
    "product": "WL-NU516U1-A",
    "versions": [
      {
        "version": "M16U1_V240425",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:a:wavlink:wl-nu516u1-a:*:*:*:*:*:*:*:*"
    ],
    "modules": [
      "POST Parameter Handler"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/submit/834024
vuldb	www.vuldb.com/vuln/374547/cti
github	www.github.com/Svigo-o/Wavlink_vul/tree/main/wavlink-wl-nu516u1-wireless-guestwifi-guestssid-buffer-overflow
dl	www.dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin
vuldb	www.vuldb.com/vuln/374547
vuldb	www.vuldb.com/cve/CVE-2026-13539

Parameter	Position	Path	Description	CWE
Guest_ssid	request body	/cgi-bin/wireless.cgi	Remote stack-based buffer overflow via POST parameter Guest_ssid in /cgi-bin/wireless.cgi (POST Parameter Handler), exploitable remotely.	CWE-119, CWE-121

29 Jun 2026 18:47Current

8High risk

Vulners AI Score8

CVSS 48.7

CVSS 3.18.8

CVSS 29

CVSS 38.8

EPSS0.00466

SSVC