CVE-2026-15513

MEDIUM

Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection

Title source: cna
STIX 2.1

Description

A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lan_ip results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-377842 | Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection
https://vuldb.com/vuln/377842
Signature, Permissions Required signature permissions-required
VDB-377842 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/377842/cti
Third Party Advisory third-party-advisory
CVE-2026-15513 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-15513
Third Party Advisory third-party-advisory
Submit #847517 | WAVLINK NU516U1 M16U1_V260515 OS Command Injection
https://vuldb.com/submit/847517

Scores

CVSS v3 6.3
EPSS 0.0142
EPSS Percentile 69.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-77 CWE-78
Status published
Products (1)
Wavlink/WL-NU516U1 260515
Published Jul 13, 2026
Tracked Since Jul 13, 2026