CVE-2026-3661CWE-74CWE-77

Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection

Medium · published March 7, 2026

CVSS v4.0

5.1

EPSS

11%

Percentile

96.0

In the wild

Unconfirmed

What it is

A flaw has been found in Wavlink WL-NU516U1 240425. This affects the function ota_new_upgrade of the file /cgi-bin/adm.cgi. This manipulation of the argument model causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

The record

Technical detail

CVSS v4.0: 5.1 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS: 0.11344 · 96.0th percentile
Weaknesses: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published: 2026-03-07T13:32Z

EPSS history

Timeline

07 MAR 13:32Z
Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection
cvelistv5