CVE-2026-18590

A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function setsysadm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly...

CVE-2026-18589

A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function changepassword of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be use...

CVE-2026-18590 Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection

A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function setsysadm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly...

CVE-2026-18590

The CVE concerns Wavlink WL-NU516U1 (firmware MT7628) where the Admin Password Handler’s function set_sys_adm in adm.cgi is vulnerable to OS command injection. The underlying issue enables a remote attacker to trigger code execution, with the exploit publicly disclosed. Impact is remote, affectin...

EUVD-2026-52189

A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function changepassword of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be use...

CVE-2026-18589

The CVE-2026-18589 entry concerns Wavlink WL-NU516U1 (model 708c073-mt7628). The vulnerability is in nas.cgi, affecting the change_password function where manipulating User1Passwd triggers a stack-based buffer overflow. It is a NETWORK-accessible flaw with LOW attack complexity and NO user intera...

EUVD-2026-52167

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENTLENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component...

CVE-2026-18588

The CVE-2026-18588 affects the Wavlink WL-NU516U1 (708c073-mt7628) device, with a stack-based buffer overflow in nas.cgi caused by manipulation of CONTENT_LENGTH. This allows remote exploitation and could impact confidentiality, integrity, and availability. A fixed version has been released by th...

CVE-2026-18588 Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENTLENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component...

CVE-2026-18587

CVE-2026-18587 affects Wavlink WL-NU516U1 (708c073-mt7628). The flaw is in an unknown function of Config Import where manipulating the Password argument can trigger an OS command injection. The issue is exploitable remotely with high impact to confidentiality, integrity, and availability (C/I/A: ...

EUVD-2026-52160

A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Wavlink Wl-Nu516U1_Firmware

cve-id Donate Support the maintenance of this project wit...

EUVD-2026-43254

A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlinkucisetvalue of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lanip results in os command injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-15513 Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection

A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlinkucisetvalue of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lanip results in os command injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-13538

A vulnerability was determined in Wavlink WL-NU516U1-A M16U1V240425. The affected element is the function sub401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote...

CVE-2026-8228

A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlanconf/Channel/skiplist/ieee80211h leads to os command injection. The attack may be launched remotely. The exploit has been...

CVE-2026-8191

A vulnerability was identified in Wavlink NU516U1 M16U1V240425. This affects the function wifiregion of the file /cgi-bin/adm.cgi. Such manipulation of the argument skiplist1/skiplist2 leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might ...

CVE-2026-8230

A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function syslogin1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. Th...

CVE-2026-8229

A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument AuthMethod/EncrypType results in os command injection. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-8227

A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. T...