CVE-2025-10775CWE-77CWE-78

Wavlink WL-NU516U1 login.cgi sub_4012A0 os command injection

Medium · published September 22, 2025

CVSS v4.0

5.1

EPSS

20%

Percentile

97.4

In the wild

Unconfirmed

What it is

A security vulnerability has been detected in Wavlink WL-NU516U1 240425. This vulnerability affects the function sub_4012A0 of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record

Technical detail

CVSS v4.0: 5.1 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS: 0.20023 · 97.4th percentile
Weaknesses: CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2025-09-22T01:02Z

EPSS history

Timeline

22 SEP 01:02Z
Wavlink WL-NU516U1 login.cgi sub_4012A0 os command injection
cvelistv5