CVE-2026-18590
Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 3, 2026
- Updated
- Aug 3, 2026
- Reserved
- Aug 2, 2026
Description
A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
WL-NU516U1Wavlink |
|
References
- VDB-385418 | Wavlink WL-NU516U1 Admin Password adm.cgi set_sys_adm os command injectionvdb-entrytechnical-description
- VDB-385418 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-18590 | CVE Analysis and Reportthird-party-advisory
- Submit #850527 | WAVLINK NU516U1 2026-05-15 (build 708c073-mt7628) Command Injectionthird-party-advisory
- Submit #850560 | WAVLINK NU516U1 2026-05-15 (build 708c073-mt7628) Command Injection (Duplicate)third-party-advisory
- https://github.com/oduoke567/WAVLINK-NU516U1-2026-05-1/blob/main/report2.mdbroken-link
- https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.binbroken-linkpatch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.