CVE-2025-10963: Wavlink WL-NU516U1 Firmware RCE Flaw

CVE-2025-10963 Overview

CVE-2025-10963 is a command injection vulnerability affecting the Wavlink WL-NU516U1 router running firmware version M16U1_V240425. The flaw resides in the sub_4016F0 function of /cgi-bin/firewall.cgi, where the del_flag parameter is passed to a shell context without proper sanitization [CWE-74]. Attackers can submit crafted HTTP requests to inject operating system commands that execute in the context of the web server. The exploit has been publicly released, and the vendor did not respond to disclosure attempts.

Critical Impact
Authenticated remote attackers can inject arbitrary operating system commands through the del_flag parameter of the firewall configuration interface, potentially compromising the router and pivoting into the local network.

Affected Products

Wavlink WL-NU516U1 router (hardware)
Wavlink WL-NU516U1 firmware version M16U1_V240425
/cgi-bin/firewall.cgi component, function sub_4016F0

Discovery Timeline

2025-09-25 - CVE-2025-10963 published to the National Vulnerability Database
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-10963

Vulnerability Analysis

The vulnerability exists in the single port forward delete handler implemented in sub_4016F0 within /cgi-bin/firewall.cgi. The handler reads the del_flag query or POST parameter and incorporates the value into a shell command without escaping or validating its contents. Because the parameter is concatenated into a command line passed to a shell interpreter, attackers can append shell metacharacters such as ;, |, or backticks to execute arbitrary commands. The Wavlink WL-NU516U1 is a consumer wireless router, and command execution occurs with the privileges of the embedded HTTP daemon, typically root on this class of device.

Root Cause

The root cause is improper neutralization of special elements used in a command [CWE-74]. The firmware passes user-controlled input from the del_flag HTTP parameter directly into a system shell call inside sub_4016F0. No allowlist, regular expression filtering, or argument quoting is applied before the parameter reaches the command interpreter.

Attack Vector

The attack vector is network-based and requires low-privilege authentication to the router web interface. An attacker who can reach the management interface, either on the local network or remotely if the interface is exposed, sends a crafted HTTP request to /cgi-bin/firewall.cgi with malicious shell payloads in the del_flag field. Successful exploitation yields arbitrary command execution on the underlying embedded Linux system. Public proof-of-concept material is documented in the GitHub Exploit Documentation and indexed in VulDB #325831.

Detection Methods for CVE-2025-10963

Indicators of Compromise

HTTP requests to /cgi-bin/firewall.cgi containing shell metacharacters (;, |, &, `, $() in the del_flag parameter.
Unexpected outbound connections originating from the router management plane after firewall configuration changes.
Modifications to router configuration files, iptables rules, or persistent startup scripts without an authorized administrator action.

Detection Strategies

Inspect web server and reverse-proxy logs for POST or GET requests to firewall.cgi with abnormal del_flag values that contain non-alphanumeric content.
Deploy network intrusion detection signatures that flag command-injection payload patterns targeting Wavlink CGI endpoints.
Baseline normal management traffic to the router and alert on deviations such as new user-agents or off-hours configuration requests.

Monitoring Recommendations

Forward router syslog and HTTP access logs to a centralized logging platform for correlation against shell-injection patterns.
Monitor DHCP and ARP tables for unauthorized devices that may be probing the router management interface.
Track failed and successful authentication attempts against the Wavlink web UI to identify credential-stuffing precursors to exploitation.

How to Mitigate CVE-2025-10963

Immediate Actions Required

Restrict access to the Wavlink WL-NU516U1 management interface to trusted management VLANs and disable any WAN-side administration.
Change default and weak credentials on the device, since exploitation requires low-privilege authenticated access.
Place affected routers behind network segmentation that limits lateral movement if the device is compromised.

Patch Information

No vendor patch is available. According to the disclosure, Wavlink was contacted but did not respond. Operators of the WL-NU516U1 on firmware M16U1_V240425 should treat the device as unpatched and consider replacement with a supported product. Track future firmware releases on the Wavlink support portal and reference VulDB #325831 for status updates.

Workarounds

Block external access to /cgi-bin/firewall.cgi at an upstream firewall or reverse proxy until the vendor releases a fix.
Disable remote management features and require administration only over a wired connection from a trusted host.
Apply egress filtering on the router subnet to limit the impact of arbitrary command execution if exploitation occurs.

bash

# Example upstream firewall rule to drop external requests to the vulnerable CGI
iptables -I FORWARD -p tcp --dport 80 -m string \
  --string "/cgi-bin/firewall.cgi" --algo bm -j DROP
iptables -I FORWARD -p tcp --dport 443 -m string \
  --string "/cgi-bin/firewall.cgi" --algo bm -j DROP