CVE-2026-4861

HIGH

Wavlink WL-NU516U1 nas.cgi ftext stack-based overflow

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-4861. PoCs published by HORKimhab.

AI-analyzed exploit summary The repository contains no actual exploit code, technical details, or vulnerability analysis for CVE-2026-4861. It only includes a README with donation requests, legal disclaimers, and placeholder instructions without any functional PoC or research content.

Description

A weakness has been identified in Wavlink WL-NU516U1 260227. This vulnerability affects the function ftext of the file /cgi-bin/nas.cgi. This manipulation of the argument Content-Length causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Exploits (1)

github STUB
by HORKimhab · poc
https://github.com/HORKimhab/CVE-2026-4861

The repository contains no actual exploit code, technical details, or vulnerability analysis for CVE-2026-4861. It only includes a README with donation requests, legal disclaimers, and placeholder instructions without any functional PoC or research content.

Classification
Stub 95%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unspecified
No auth needed
mistral-large-3 · analyzed Jul 27, 2026 Full analysis →

References (4)

Core 4
Core References
Signature, Permissions Required signature permissions-required
VDB-353192 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/?ctiid.353192
Third Party Advisory third-party-advisory
Submit #776217 | Wavlink NU516U1 V260227 Stack-based Buffer Overflow
https://vuldb.com/?submit.776217
Vdb Entry, Technical Description vdb-entry technical-description
VDB-353192 | Wavlink WL-NU516U1 nas.cgi ftext stack-based overflow
https://vuldb.com/?id.353192

Scores

CVSS v3 8.8
EPSS 0.0085
EPSS Percentile 54.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-119 CWE-121
Status published
Products (2)
Wavlink/WL-NU516U1 260227
wavlink/wl-nu516u1_firmware m16u1_v260227
Published Mar 26, 2026
Tracked Since Mar 26, 2026