CVE-2026-18590 Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection

A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function setsysadm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly...

CVE-2026-18590

The CVE concerns Wavlink WL-NU516U1 (firmware MT7628) where the Admin Password Handler’s function set_sys_adm in adm.cgi is vulnerable to OS command injection. The underlying issue enables a remote attacker to trigger code execution, with the exploit publicly disclosed. Impact is remote, affectin...

CVE-2026-18589 Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow

A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function changepassword of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be use...

EUVD-2026-52189

A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function changepassword of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be use...

CVE-2026-18589

The CVE-2026-18589 entry concerns Wavlink WL-NU516U1 (model 708c073-mt7628). The vulnerability is in nas.cgi, affecting the change_password function where manipulating User1Passwd triggers a stack-based buffer overflow. It is a NETWORK-accessible flaw with LOW attack complexity and NO user intera...

EUVD-2026-52167

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENTLENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component...

CVE-2026-18588

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENTLENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component...

CVE-2026-18588

The CVE-2026-18588 affects the Wavlink WL-NU516U1 (708c073-mt7628) device, with a stack-based buffer overflow in nas.cgi caused by manipulation of CONTENT_LENGTH. This allows remote exploitation and could impact confidentiality, integrity, and availability. A fixed version has been released by th...

CVE-2026-18588 Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENTLENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component...

CVE-2026-18587

CVE-2026-18587 affects Wavlink WL-NU516U1 (708c073-mt7628). The flaw is in an unknown function of Config Import where manipulating the Password argument can trigger an OS command injection. The issue is exploitable remotely with high impact to confidentiality, integrity, and availability (C/I/A: ...

EUVD-2026-52160

A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high...

CVE-2026-18587 Wavlink WL-NU516U1 Config Import os command injection

A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Wavlink Wl-Nu516U1_Firmware

cve-id Donate Support the maintenance of this project wit...

EUVD-2026-43254

A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlinkucisetvalue of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lanip results in os command injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-15513

A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlinkucisetvalue of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lanip results in os command injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-15513

The CVE-2026-15513 vulnerability affects the Wavlink WL-NU516U1 (model 260515) in the CGI handler /cgi-bin/adm.cgi, specifically the wlink_uci_set_value function. An attacker can remotely manipulate the lan_ip argument to trigger an OS command injection. Impact is described as network-accessible ...

CVE-2026-15513 Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection

A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlinkucisetvalue of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lanip results in os command injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-13539

A vulnerability was identified in Wavlink WL-NU516U1-A M16U1V240425. The impacted element is the function sub407504 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. Such manipulation of the argument Guestssid leads to stack-based buffer overflow. The attack can be execut...

CVE-2026-13538

A vulnerability was determined in Wavlink WL-NU516U1-A M16U1V240425. The affected element is the function sub401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote...

CVE-2026-13539

The CVE concerns Wavlink WL-NU516U1-A M16U1_V240425. The vulnerable component is the POST Parameter Handler in /cgi-bin/wireless.cgi, specifically function sub_407504, where manipulation of Guest_ssid causes a stack-based buffer overflow. This can be triggered remotely; exploitation is publicly a...