CVE-2026-18587: Wavlink WL-NU516U1 RCE Vulnerability

CVE-2026-18587 Overview

CVE-2026-18587 is an operating system command injection vulnerability affecting the Wavlink WL-NU516U1 router running firmware 708c073-mt7628. The flaw resides in the Config Import component, where the Password argument is passed to an underlying shell without adequate sanitization. An attacker who can reach the affected function and induce a user to trigger the import operation can execute arbitrary OS commands on the device. The issue is tracked under CWE-77 and a public exploit has been referenced. Wavlink responded to the report and released a fixed firmware image.

Critical Impact
Successful exploitation grants arbitrary OS command execution on the router, exposing confidentiality, integrity, and availability of the device and any traffic it handles.

Affected Products

Wavlink WL-NU516U1 router
Firmware build 708c073-mt7628
Config Import component (Password parameter)

Discovery Timeline

2026-08-03 - CVE-2026-18587 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18587

Vulnerability Analysis

The vulnerability is an OS command injection ([CWE-77]) in the Config Import feature of the Wavlink WL-NU516U1 web management interface. The Password argument accepted during a configuration import operation is concatenated into a shell invocation without proper neutralization of special elements. An attacker who crafts a malicious configuration file or request can embed shell metacharacters inside the Password field. When the device processes the import, the injected payload executes with the privileges of the handling process, which on this class of MediaTek MT7628-based device typically runs as root. Because the attack requires user interaction and a specific import workflow, exploitation is characterized as high complexity.

Root Cause

The root cause is missing input validation and unsafe construction of a shell command in the Config Import handler. The firmware does not sanitize or quote the Password argument before it reaches a system-level shell call, allowing metacharacters such as ;, |, &, or backticks to break out of the intended string context.

Attack Vector

The attack vector is network-based but requires user interaction to load an attacker-supplied configuration through the Config Import function. Successful exploitation yields command execution on the router, enabling persistence, credential theft, traffic interception, or pivoting to internal hosts. A proof-of-concept has been published in the referenced GitHub Vulnerability Report; refer to the VulDB entry for CVE-2026-18587 for additional technical context.

Detection Methods for CVE-2026-18587

Indicators of Compromise

Unexpected outbound connections from the router management interface following a configuration import event.
Configuration backup files containing shell metacharacters (;, |, `, $() inside the Password field.
Modification of router firmware or persistence artifacts on the MT7628 filesystem outside a scheduled maintenance window.

Detection Strategies

Inspect HTTP requests to the router administrative interface for Config Import operations carrying suspicious Password values.
Alert on router-originated network traffic to unfamiliar external hosts, including DNS lookups initiated by the device itself.
Correlate device management events with subsequent lateral movement or credential access attempts on the internal network.

Monitoring Recommendations

Log and retain administrative access to Wavlink devices, including source IP, user agent, and imported file hashes.
Monitor DHCP, ARP, and DNS behavior of the router for signs of tampering following administrative sessions.
Track firmware version strings across the fleet to identify devices still running 708c073-mt7628.

How to Mitigate CVE-2026-18587

Immediate Actions Required

Upgrade affected devices to the fixed firmware image published by the vendor.
Restrict access to the router administrative interface to trusted management subnets only.
Do not import configuration files received from untrusted sources or through unverified channels.
Rotate router administrative credentials and any credentials that transited the device after suspected exploitation.

Patch Information

Wavlink has released a fixed firmware image. Download the updated build from the vendor at Wavlink Firmware Download and apply it through the standard system upgrade procedure. Verify the resulting firmware version reports the patched build (4b8a21f-mt7628 dated 2026-07-13) before returning the device to production.

Workarounds

Disable remote administrative access on the WAN interface until patching is completed.
Enforce network segmentation to isolate management traffic from user and guest VLANs.
Block the Config Import endpoint at an upstream proxy or firewall where feasible.

bash

# Configuration example: restrict router management access with iptables
iptables -A INPUT -i wan0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i wan0 -p tcp --dport 443 -j DROP
iptables -A INPUT -s 10.0.10.0/24 -p tcp --dport 443 -j ACCEPT