CVE-2026-8189: Wavlink WL-NU516U1 Firmware RCE Vulnerability

CVE-2026-8189 Overview

CVE-2026-8189 is an operating system command injection vulnerability affecting the Wavlink NU516U1 router running firmware M16U1_V240425. The flaw resides in the wzdrepeater function within the /cgi-bin/adm.cgi endpoint. Attackers can manipulate the wlan_bssid, sel_Automode, or sel_EncrypTyp parameters to inject arbitrary operating system commands. The vulnerability is remotely exploitable and requires low-level authentication. Public exploit details have been released, and the vendor was notified prior to disclosure. The issue is classified under [CWE-77]: Improper Neutralization of Special Elements used in a Command.

Critical Impact
Authenticated remote attackers can execute arbitrary operating system commands on affected Wavlink routers, potentially leading to full device compromise and pivoting into adjacent network segments.

Affected Products

Wavlink WL-NU516U1 hardware device
Wavlink WL-NU516U1 firmware version M16U1_V240425
Deployments exposing the /cgi-bin/adm.cgi administrative interface

Discovery Timeline

2026-05-09 - CVE-2026-8189 published to the National Vulnerability Database
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-8189

Vulnerability Analysis

The vulnerability exists in the wzdrepeater handler of the /cgi-bin/adm.cgi Common Gateway Interface (CGI) script. This handler processes wireless repeater configuration requests submitted through the device's administrative web interface. Three user-controlled parameters, wlan_bssid, sel_Automode, and sel_EncrypTyp, are passed to system shell invocations without proper sanitization or neutralization of shell metacharacters.

Because the input flows directly into a command interpreter, an authenticated attacker can append shell separators such as semicolons, backticks, or pipe characters to execute commands as the web server process. On embedded routers, this process typically runs with elevated privileges, allowing attackers to alter firewall rules, modify DNS settings, persist implants, or extract stored credentials.

Root Cause

The root cause is a failure to neutralize special elements used in OS commands [CWE-77]. The wzdrepeater routine concatenates request parameters into command strings rather than passing them as discrete arguments through safe execution APIs. No allow-list validation is performed on the BSSID format, automatic mode selector, or encryption type selector before invocation.

Attack Vector

An attacker with low-privilege access to the router's administrative interface sends a crafted HTTP request to /cgi-bin/adm.cgi targeting the wzdrepeater action. The attacker embeds shell metacharacters in wlan_bssid, sel_Automode, or sel_EncrypTyp to break out of the intended command context. Refer to the GitHub vulnerability report and VulDB entry #362341 for documented request structure and parameter handling details.

Detection Methods for CVE-2026-8189

Indicators of Compromise

HTTP POST requests to /cgi-bin/adm.cgi containing the wzdrepeater action combined with shell metacharacters (;, |, `, $()) in wlan_bssid, sel_Automode, or sel_EncrypTyp parameters.
Unexpected outbound connections originating from the router to attacker-controlled infrastructure following administrative HTTP traffic.
Modified router configuration files, new cron entries, or unfamiliar processes spawned by the httpd or CGI handler.

Detection Strategies

Inspect web server and reverse proxy logs in front of the device for requests targeting adm.cgi with non-alphanumeric content in wireless configuration parameters.
Apply network intrusion detection signatures that flag command injection patterns in HTTP request bodies sent to embedded device management endpoints.
Baseline normal administrative request patterns and alert on deviations such as off-hours configuration changes or requests from unexpected source addresses.

Monitoring Recommendations

Forward router syslog output to a centralized log platform and retain HTTP access logs for parameter-level analysis.
Monitor DNS and outbound traffic from router management VLANs to identify command-and-control beaconing originating from compromised firmware.
Track firmware version drift across the fleet to detect rollbacks or unauthorized image changes.

How to Mitigate CVE-2026-8189

Immediate Actions Required

Remove the administrative interface of Wavlink NU516U1 devices from any untrusted network and restrict access to a dedicated management VLAN.
Rotate administrative credentials and disable any default or shared accounts that could be abused to reach the vulnerable wzdrepeater handler.
Audit recent router configuration changes, DNS settings, and firewall rules for unauthorized modifications.

Patch Information

No vendor advisory or fixed firmware version was listed at the time of publication. Consult the VulDB record for CVE-2026-8189 and the Wavlink support portal for updated firmware availability. Until a patched build is released, treat affected devices as untrusted on the network.

Workarounds

Block external access to /cgi-bin/adm.cgi at the network perimeter and restrict it to a small set of administrative hosts.
Place vulnerable routers behind a segmented management network with no direct internet exposure and require VPN access for administration.
Where feasible, replace the affected NU516U1 hardware with a supported model that receives current security updates.

bash

# Example iptables rule to restrict access to the vulnerable CGI endpoint
# Allow only the management subnet 10.10.0.0/24 to reach the admin interface
iptables -A INPUT -p tcp --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP