CVE-2026-3662CWE-74CWE-77

Wavlink WL-NU516U1 adm.cgi usb_p910 command injection

Medium · published March 7, 2026

CVSS v4.0

5.1

EPSS

11%

Percentile

96.0

In the wild

Unconfirmed

What it is

A vulnerability has been found in Wavlink WL-NU516U1 240425. This vulnerability affects the function usb_p910 of the file /cgi-bin/adm.cgi. Such manipulation of the argument Pr_mode leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

The record

Technical detail

CVSS v4.0: 5.1 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS: 0.11344 · 96.0th percentile
Weaknesses: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published: 2026-03-07T13:32Z

EPSS history

Timeline

07 MAR 13:32Z
Wavlink WL-NU516U1 adm.cgi usb_p910 command injection
cvelistv5