CVE-2025-10960 Overview
CVE-2025-10960 is a command injection vulnerability in the Wavlink NU516U1 router running firmware M16U1_V240425. The flaw resides in the sub_402D1C function within /cgi-bin/wireless.cgi, which handles the DeleteMac page. An authenticated remote attacker can manipulate the delete_list argument to inject operating system commands [CWE-74]. The vendor was contacted prior to public disclosure but did not respond. A public proof-of-concept exists, and the EPSS score sits at 6.899% (93.227 percentile), indicating elevated likelihood of exploitation attempts despite the low CVSS rating.
Critical Impact
Authenticated attackers can execute arbitrary operating system commands on affected Wavlink NU516U1 devices through the wireless management CGI endpoint.
Affected Products
- Wavlink WL-NU516U1 hardware (all units running the affected firmware)
- Wavlink WL-NU516U1 firmware version M16U1_V240425
- Any deployment exposing the device web management interface to untrusted networks
Discovery Timeline
- 2025-09-25 - CVE-2025-10960 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2025-10960
Vulnerability Analysis
The vulnerability exists in the sub_402D1C function of /cgi-bin/wireless.cgi, which processes MAC address deletion requests from the DeleteMac administrative page. The function consumes the delete_list parameter and passes it into a shell context without adequate sanitization. Attackers who can authenticate to the web interface can append shell metacharacters to the parameter value, causing the underlying operating system to execute attacker-controlled commands. Because the binary runs with elevated privileges on the embedded Linux platform, successful injection typically yields full device control. Public proof-of-concept material describing the request structure has been published, lowering the barrier to weaponization.
Root Cause
The root cause is improper neutralization of special elements used in an OS command [CWE-74]. The CGI handler concatenates user-supplied delete_list data directly into a system call rather than using an argument array or strict input allow-listing. Shell metacharacters such as ;, |, &, and backticks pass through unchanged.
Attack Vector
Exploitation requires network access to the device web interface and valid low-privilege credentials. The attacker submits a crafted POST request to the DeleteMac endpoint with a malicious delete_list value containing command separators followed by arbitrary shell commands. The CGI process executes the injected payload in the context of the web server account, which on Wavlink consumer firmware typically runs as root.
No verified exploit code is reproduced here. Technical request details are documented in the public proof-of-concept on GitHub and the VulDB entry #325828.
Detection Methods for CVE-2025-10960
Indicators of Compromise
- HTTP POST requests to /cgi-bin/wireless.cgi containing shell metacharacters (;, |, &, $(, backticks) inside the delete_list parameter.
- Unexpected child processes spawned by the wireless.cgi binary, such as sh, wget, curl, tftp, or nc.
- Outbound connections from the router to unfamiliar IP addresses shortly after administrative HTTP traffic.
- New or modified files in writable firmware paths such as /tmp, /var, or /etc following access to the DeleteMac page.
Detection Strategies
- Inspect upstream traffic to the router management interface for non-MAC-address content in the delete_list field.
- Correlate authentication events on the router with subsequent egress traffic to identify post-login command execution patterns.
- Apply network signatures matching command injection payloads targeting wireless.cgi at perimeter sensors and TLS-terminating proxies.
Monitoring Recommendations
- Forward router syslog and web access logs to a centralized SIEM and alert on requests to /cgi-bin/wireless.cgi from non-administrative sources.
- Baseline expected administrative IP addresses and flag DeleteMac requests originating from outside that set.
- Monitor for firmware tampering indicators including unscheduled reboots, configuration changes, and DNS setting modifications.
How to Mitigate CVE-2025-10960
Immediate Actions Required
- Restrict access to the router management interface to trusted internal hosts and disable WAN-side administration.
- Rotate all administrative credentials on affected NU516U1 devices and enforce strong, unique passwords.
- Segment Wavlink NU516U1 devices onto a dedicated VLAN with strict egress filtering until a patch is available.
- Audit recent administrative sessions and inspect device configuration for unauthorized changes.
Patch Information
Wavlink has not published an official advisory or firmware update addressing CVE-2025-10960 at the time of NVD publication. The vendor did not respond to coordinated disclosure attempts. Organizations should track the VulDB entry #325828 for updates and consider replacing affected hardware if a fix is not released.
Workarounds
- Disable remote management entirely and require physical or VPN access for any administrative action on the device.
- Place the device behind a reverse proxy or firewall that filters HTTP requests containing shell metacharacters in the delete_list parameter.
- Replace end-of-support consumer-grade hardware with vendor-supported equipment that receives regular security updates.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
