CVE-2026-15513: Wavlink WL-NU516U1 RCE Vulnerability

CVE-2026-15513 Overview

CVE-2026-15513 is an operating system command injection vulnerability affecting the Wavlink WL-NU516U1 router running firmware version 260515. The flaw resides in the wlink_uci_set_value function within /cgi-bin/adm.cgi. An authenticated attacker can manipulate the lan_ip argument to inject arbitrary operating system commands. The attack is initiated remotely across the network. Public exploit code has been released, increasing the likelihood of opportunistic exploitation against exposed devices. Wavlink was contacted through coordinated disclosure and released a fixed firmware image.

Critical Impact
Authenticated remote attackers can execute arbitrary operating system commands on the router, leading to full device compromise and pivoting into the connected network.

Affected Products

Wavlink WL-NU516U1 router
Firmware version 260515
/cgi-bin/adm.cgi administrative interface

Discovery Timeline

2026-07-13 - CVE-2026-15513 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15513

Vulnerability Analysis

The vulnerability is classified under [CWE-77] Improper Neutralization of Special Elements used in a Command. The affected component is the wlink_uci_set_value function implemented in the /cgi-bin/adm.cgi CGI binary. This function processes administrative configuration parameters submitted through the router's web interface.

The lan_ip parameter is passed to the underlying operating system without proper input sanitization. Attackers can append shell metacharacters and additional commands to the parameter value. The injected commands execute with the privileges of the CGI process, typically root on embedded MIPS-based Wavlink devices.

A related proof-of-concept demonstrates chaining the injection with Cross-Site Request Forgery (CSRF), allowing an attacker to trigger the flaw via a victim's authenticated browser session.

Root Cause

The root cause is missing input validation and neutralization of shell metacharacters in the wlink_uci_set_value handler. User-supplied data flows directly into a system command execution routine without escaping or allow-list filtering.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker submits a crafted HTTP request to /cgi-bin/adm.cgi containing a malicious lan_ip value. Metacharacters such as semicolons or backticks terminate the intended command and append attacker-controlled instructions. Because the exploit is public and CSRF-capable, adversaries can also weaponize the flaw against administrators who visit malicious web pages while authenticated to the router.

See the GitHub CSRF Command Injection proof-of-concept for technical details of the attack chain.

Detection Methods for CVE-2026-15513

Indicators of Compromise

HTTP POST or GET requests to /cgi-bin/adm.cgi containing shell metacharacters (;, |, &, `, $()) in the lan_ip parameter
Unexpected outbound connections from the router to attacker-controlled infrastructure following administrative requests
New or modified processes on the router (telnetd, nc, wget, curl) spawned by the CGI process
Unauthorized changes to router UCI configuration or firmware persistence artifacts

Detection Strategies

Inspect web server and CGI access logs on the device for anomalous lan_ip values containing non-IP characters
Monitor network traffic between clients and the router for CSRF patterns targeting /cgi-bin/adm.cgi
Deploy network intrusion detection signatures for command injection patterns against Wavlink administrative endpoints

Monitoring Recommendations

Alert on any router-initiated outbound traffic to non-standard destinations or ports
Track DNS queries originating from router management interfaces for unusual lookups
Correlate administrator browser sessions with router configuration change events to detect CSRF-driven exploitation

How to Mitigate CVE-2026-15513

Immediate Actions Required

Upgrade the affected Wavlink WL-NU516U1 device to the fixed firmware published by the vendor
Restrict access to the router's administrative interface to trusted management VLANs or hosts
Rotate administrative credentials after patching in case the device was previously exposed
Audit router configuration and running processes for signs of prior compromise

Patch Information

Wavlink released a fixed firmware image dated 2026-06-22. Administrators should download and apply the update from the Wavlink Firmware Update page. Additional advisory context is available at VulDB CVE-2026-15513.

Workarounds

Disable remote management on the WAN interface until the firmware update is applied
Enforce strong, unique administrator passwords to reduce the risk of authenticated exploitation
Log out of the router web interface when not in use to mitigate CSRF-based exploitation chains
Place the device behind a network segment that blocks untrusted HTTP requests to /cgi-bin/adm.cgi

bash

# Configuration example: restrict admin interface to a management subnet
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP