CVE-2026-3703CWE-119CWE-787

Wavlink NU516U1 login.cgi sub_401A10 out-of-bounds write

Critical · published March 8, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
69.3
In the wild
Unconfirmed
What it is

A flaw has been found in Wavlink NU516U1 251208. This affects the function sub_401A10 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to out-of-bounds write. The attack may be performed from remote. The exploit has been published and may be used. Upgrading the affected component is recommended. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.01256 · 69.3th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-787 · Out-of-bounds Write
Published
2026-03-08T04:32Z
EPSS history
Timeline
  • 08 MAR 04:32Z
    Wavlink NU516U1 login.cgi sub_401A10 out-of-bounds write
    cvelistv5