CVE-2025-10961: Wavlink WL-NU516U1 Firmware RCE Vulnerability

CVE-2025-10961 Overview

CVE-2025-10961 is a command injection vulnerability in the Wavlink NU516U1 router running firmware version M16U1_V240425. The flaw resides in the sub_4030C0 function within /cgi-bin/wireless.cgi, which processes requests from the Delete_Mac_list page. An authenticated attacker on an adjacent network can manipulate the delete_list argument to inject arbitrary operating system commands. The vendor was contacted about the disclosure but did not respond, leaving affected devices without an official patch. The vulnerability is tracked under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Successful exploitation allows an authenticated attacker on the local network to execute arbitrary commands on the router with the privileges of the CGI process, enabling persistent device compromise.

Affected Products

Wavlink WL-NU516U1 hardware (all revisions covered by CPE cpe:2.3:h:wavlink:wl-nu516u1:-)
Wavlink WL-NU516U1 firmware version M16U1_V240425
Any deployment exposing the /cgi-bin/wireless.cgi Delete_Mac_list interface on adjacent networks

Discovery Timeline

2025-09-25 - CVE-2025-10961 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10961

Vulnerability Analysis

The vulnerability exists in the sub_4030C0 function of the /cgi-bin/wireless.cgi binary, which handles MAC address entry removal from the wireless access control list. The Delete_Mac_list page accepts a delete_list parameter containing MAC address values intended for removal from the filter table. Instead of validating or escaping the input, the handler passes the parameter into a shell command execution context. An authenticated user on the same network segment can append shell metacharacters to the delete_list argument to break out of the intended command and execute arbitrary code on the underlying Linux system.

Command execution occurs with the privilege level of the web server process, which on most Wavlink consumer routers runs as root. This grants full control over the device, including firmware persistence, credential theft, and pivoting into connected networks.

Root Cause

The root cause is improper neutralization of shell metacharacters [CWE-74] in the input processing path of the Delete_Mac_list handler. The sub_4030C0 function concatenates user-controlled data into a command string executed through a shell interpreter such as system() or popen(), without sanitizing characters like ;, |, &, or backticks.

Attack Vector

The attack requires network adjacency (AV:A) and low-level authentication (PR:L). An attacker connected to the router's LAN or Wi-Fi with valid credentials issues a crafted POST request to /cgi-bin/wireless.cgi targeting the Delete_Mac_list action. The delete_list parameter carries a MAC-like prefix followed by shell metacharacters and injected commands, which the CGI binary executes on the device.

See the public vulnerability writeup and VulDB entry #325829 for the parameter structure and reproduction steps.

Detection Methods for CVE-2025-10961

Indicators of Compromise

Unexpected POST requests to /cgi-bin/wireless.cgi referencing the Delete_Mac_list action from LAN clients
Presence of shell metacharacters (;, |, &, `, $() inside the delete_list parameter value in HTTP logs
Router processes spawning unexpected child processes such as sh, wget, curl, tftp, or nc
Outbound connections from the router to unfamiliar IP addresses shortly after LAN administrative activity

Detection Strategies

Inspect router access logs and any upstream reverse proxy logs for anomalous parameter content on /cgi-bin/wireless.cgi endpoints
Monitor DNS and NetFlow telemetry from the router's management IP for beaconing patterns or payload retrieval
Baseline expected administrative traffic to the router and alert on deviations in request frequency, source, or timing

Monitoring Recommendations

Enable syslog forwarding from the router to a central collector and ingest into a SIEM for correlation
Track authentication events on the router web interface and alert on failed-then-successful sequences preceding configuration changes
Capture packet metadata for management-plane traffic and retain for forensic review of injection attempts

How to Mitigate CVE-2025-10961

Immediate Actions Required

Restrict access to the router's administrative interface to a dedicated management VLAN or a small set of trusted hosts
Rotate all administrative credentials on the WL-NU516U1 and disable any shared or default accounts
Disable remote management if enabled and ensure the web UI is not reachable from the WAN
Segment the router from sensitive internal assets so a compromise does not provide lateral pivot opportunities

Patch Information

No vendor patch is available. Wavlink did not respond to the disclosure attempt referenced in the VulDB CTI report #325829. Organizations still operating the WL-NU516U1 with firmware M16U1_V240425 should plan replacement with a supported device or apply the compensating controls listed below until the vendor issues a fix.

Workarounds

Place the router behind a network access control layer that limits which endpoints can reach /cgi-bin/wireless.cgi
Deploy a Wi-Fi client isolation policy to prevent untrusted wireless clients from reaching the management interface
Replace the affected device with a currently supported router if long-term production use is required
Monitor the public advisory and VulDB #325829 for future vendor updates

bash

# Example: restrict router admin access with an upstream firewall rule
# Allow only the management host 10.10.0.25 to reach the router web UI at 192.168.1.1
iptables -A FORWARD -s 10.10.0.25 -d 192.168.1.1 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 192.168.1.1 -p tcp --dport 80 -j DROP