CVE-2026-2615

🗓️ 17 Feb 2026 13:02:06Reported by VulDBType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 14 Views🌐 WEB

Wavlink firewall.cgi singlePortForwardDelete enables command injection via del_flag for remote access.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-2615	17 Feb 202613:02	–	attackerkb
CNNVD	WAVLINK WL-NU516U1 安全漏洞	17 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-2615 Wavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injection	17 Feb 202613:02	–	cvelist
NVD	CVE-2026-2615	17 Feb 202613:16	–	nvd
Positive Technologies	PT-2026-20333	17 Feb 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-2615	18 Feb 202613:28	–	redhatcve
Vulnrichment	CVE-2026-2615 Wavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injection	17 Feb 202613:02	–	vulnrichment

NVD

Vulners

Node

wavlink wl-nu516u1_firmwareRange≤2025-12-08

AND

wavlink wl-nu516u1Match-

[
  {
    "vendor": "Wavlink",
    "product": "WL-NU516U1",
    "versions": [
      {
        "version": "20251208",
        "status": "affected"
      }
    ],
    "cpes": [
      "cpe:2.3:o:wavlink:wl-nu516u1_firmware:*:*:*:*:*:*:*:*"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/Wlz1112/Wavlink-NU516U1-V251208-/blob/main/singlePortForwardDelete.md
vuldb	www.vuldb.com/
github	www.github.com/Wlz1112/Wavlink-NU516U1-V251208-/blob/main/singlePortForwardDelete.md

Parameter	Position	Path	Description	CWE
del_flag	query param	/cgi-bin/firewall.cgi	Remote command injection via del_flag parameter in singlePortForwardDelete function.	CWE-74, CWE-77

17 Jun 2026 10:31Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.2

CVSS 28.3

CVSS 48.6

CVSS 37.2

EPSS0.08649

SSVC