- High 7.3
CVE-2026-3612
A vulnerability was determined in Wavlink WL-NU516U1 V240425. This affects the function sub_405AF4 of the file /cgi-bin/adm.cgi of the component OTA Online Upgrade. This manipulation of the argument firmware_url causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Scores
The facts
- Published
- 6 March 2026
- Last changed
- 17 June 2026
- NVD status
- Analyzed
- Severity
- High, CVSS 7.3 out of 10 (version 4.0)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R… - Weakness
- Affects
- wavlink wl-nu516u1 firmware
- Known exploited
- Not in the CISA Known Exploited Vulnerabilities catalogue in this build.
- EPSS
- 10.4% chance of exploitation activity in the next 30 days (percentile 96).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.