CVE-2025-10958 Overview
CVE-2025-10958 is a command injection vulnerability in the Wavlink WL-NU516U1 wireless router running firmware version M16U1_V240425. The flaw resides in the sub_403010 function inside /cgi-bin/wireless.cgi, which handles requests from the AddMac Page component. Attackers can manipulate the macAddr argument to inject operating system commands that the device executes. Remote exploitation is possible over the network, and a public proof-of-concept has been released. The vendor was contacted before disclosure but did not respond. This issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).
Critical Impact
Remote authenticated attackers can inject arbitrary OS commands through the macAddr parameter on the AddMac Page, leading to command execution on the affected Wavlink router.
Affected Products
- Wavlink WL-NU516U1 hardware device
- Wavlink WL-NU516U1 firmware version M16U1_V240425
- Deployments exposing /cgi-bin/wireless.cgi to untrusted networks
Discovery Timeline
- 2025-09-25 - CVE-2025-10958 published to the National Vulnerability Database (NVD)
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2025-10958
Vulnerability Analysis
The vulnerability is a command injection flaw in the binary CGI handler wireless.cgi. The sub_403010 function processes input submitted from the AddMac Page, which allows administrators to register MAC addresses for wireless filtering or access control. Input supplied through the macAddr parameter is not properly neutralized before being passed to a downstream shell context. Attackers who can reach the router's web management interface and authenticate with low privileges can append shell metacharacters to the macAddr value. The injected payload executes in the context of the CGI process, typically running with elevated privileges on embedded Linux routers.
Root Cause
The root cause is the absence of input validation and shell metacharacter sanitization in sub_403010. The function constructs a system command string that incorporates the attacker-controlled macAddr argument without escaping or whitelisting. This matches the [CWE-74] pattern where data crosses a trust boundary into a command interpreter.
Attack Vector
Exploitation requires network access to the router's HTTP management interface and a low-privilege authenticated session. An attacker submits a crafted POST request to the AddMac endpoint of /cgi-bin/wireless.cgi with a macAddr value containing command separators such as ;, |, or backticks. The injected payload is concatenated into a shell command executed by the CGI binary. A public proof-of-concept is available at the GitHub Proof of Concept repository.
No verified exploit code is reproduced here. Refer to the VulDB #325826 Detail entry and the linked PoC for technical specifics on the request structure and payload format.
Detection Methods for CVE-2025-10958
Indicators of Compromise
- HTTP POST requests to /cgi-bin/wireless.cgi containing shell metacharacters (;, |, &, backticks, $()) in the macAddr parameter.
- Unexpected child processes spawned by wireless.cgi, such as sh, wget, curl, nc, or telnetd.
- Outbound connections from the router to unfamiliar IP addresses shortly after AddMac requests.
- New or modified files in writable router directories (for example /tmp) following web management activity.
Detection Strategies
- Inspect web server and reverse proxy logs for requests to the AddMac endpoint with macAddr values that do not match the standard MAC address format XX:XX:XX:XX:XX:XX.
- Deploy network IDS signatures that flag command injection metacharacters in CGI parameters bound for Wavlink management interfaces.
- Correlate authentication events with administrative configuration requests to identify low-privilege accounts performing unusual changes.
Monitoring Recommendations
- Capture full HTTP request bodies for traffic targeting embedded device management interfaces and forward them to a centralized logging platform.
- Alert on any egress traffic originating from router management IP addresses, since these devices should rarely initiate outbound connections.
- Track firmware version inventory and flag any Wavlink WL-NU516U1 units running M16U1_V240425.
How to Mitigate CVE-2025-10958
Immediate Actions Required
- Restrict access to the router's web management interface to trusted management VLANs and remove any exposure to the public internet.
- Rotate all administrative credentials on affected Wavlink devices and disable shared low-privilege accounts that are not strictly required.
- Audit the device for signs of post-exploitation activity, including unexpected processes, cron entries, and modified startup scripts.
Patch Information
No vendor patch is available. According to the disclosure, Wavlink was contacted prior to publication but did not respond. Monitor the VulDB #325826 record and the vendor support channels for any future firmware update that supersedes M16U1_V240425.
Workarounds
- Block external access to TCP ports hosting the router's management interface using upstream firewall rules.
- Place affected devices behind a network segment that requires VPN access for administration.
- Consider replacing the WL-NU516U1 with a supported device if the vendor does not issue a fix and the router is deployed in a sensitive environment.
- Disable the AddMac functionality through the web UI if it is not actively used in the deployment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
