CVE-2026-8190: Wavlink WL-NU516U1 Firmware RCE Vulnerability

CVE-2026-8190 Overview

CVE-2026-8190 is an OS command injection vulnerability in the Wavlink NU516U1 router running firmware M16U1_V240425. The flaw resides in the wan function of the /cgi-bin/adm.cgi endpoint. Attackers can manipulate the ppp_username, ppp_passwd, rwan_ip, rwan_mask, and rwan_gateway parameters, which are passed directly to the underlying operating system without sanitization. The vulnerability is exploitable remotely and has been publicly disclosed. The vendor was contacted prior to public disclosure but did not respond. This issue is tracked under CWE-77 (Improper Neutralization of Special Elements used in a Command).

Critical Impact

Authenticated remote attackers can inject arbitrary operating system commands through WAN configuration parameters, leading to full device compromise.

Affected Products

• Wavlink WL-NU516U1 hardware appliance
• Wavlink WL-NU516U1 firmware version M16U1_V240425
• Devices exposing the /cgi-bin/adm.cgi administrative interface

Discovery Timeline

• 2026-05-09 - CVE-2026-8190 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-8190

Vulnerability Analysis

The vulnerability exists in the wan handler implemented in /cgi-bin/adm.cgi, which processes WAN configuration requests submitted from the administrative web interface. The handler accepts user-supplied values for PPP credentials and static WAN networking parameters and forwards them to system-level network configuration commands. Because the inputs are concatenated into shell command strings without neutralization, shell metacharacters embedded in the parameters are interpreted by the OS shell. The router runs services with elevated privileges, so injected commands execute with root-equivalent access to the embedded Linux environment.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The five vulnerable parameters (ppp_username, ppp_passwd, rwan_ip, rwan_mask, rwan_gateway) are passed directly to shell command construction without input validation, escaping, or use of parameterized execution APIs. Standard shell metacharacters such as ;, |, &&, and backticks break out of the intended command context.

Attack Vector

Exploitation requires network access to the router's administrative interface and low-privilege authentication. An attacker submits a crafted POST request to /cgi-bin/adm.cgi invoking the wan function, embedding shell commands in any of the affected parameters. When the handler processes the request, the injected payload executes on the device. Public proof-of-concept documentation is available at the GitHub vulnerability writeup and the VulDB entry #362342.

No verified exploit code is reproduced here. The referenced advisory describes appending shell metacharacter sequences to the affected WAN parameters in an authenticated administrative request.

Detection Methods for CVE-2026-8190

Indicators of Compromise

• HTTP POST requests to /cgi-bin/adm.cgi containing shell metacharacters (;, |, `, $()) in the ppp_username, ppp_passwd, rwan_ip, rwan_mask, or rwan_gateway fields
• Unexpected outbound connections from the router to attacker-controlled infrastructure
• New or modified processes on the device, particularly shells spawned from the adm.cgi handler
• Configuration changes to WAN settings that the administrator did not initiate

Detection Strategies

• Inspect web server and reverse proxy logs in front of the router for requests targeting /cgi-bin/adm.cgi with the wan action and non-conforming parameter values
• Apply IDS/IPS signatures matching shell metacharacter patterns inside Wavlink WAN configuration parameters
• Monitor north-south traffic from SOHO routers for command-and-control beaconing patterns

Monitoring Recommendations

• Capture and centralize syslog from the Wavlink device and any upstream firewall to a SIEM for retroactive search
• Alert on administrative interface authentications from non-management network ranges
• Track firmware integrity and configuration baselines, alerting on out-of-band changes

How to Mitigate CVE-2026-8190

Immediate Actions Required

• Restrict access to the router's administrative interface to trusted management VLANs only and disable WAN-side administration
• Rotate administrative credentials, since exploitation requires authentication and reused or weak credentials lower the barrier
• Review device configuration and logs for evidence of unauthorized WAN parameter changes or shell activity

Patch Information

As of the last NVD modification on 2026-05-13, no vendor patch is referenced for firmware M16U1_V240425. The vendor was contacted early about the disclosure but no fixed release is documented. Monitor the Wavlink support portal and the VulDB advisory for updates.

Workarounds

• Place the Wavlink NU516U1 behind a network segment that blocks untrusted access to TCP ports serving /cgi-bin/adm.cgi
• Disable remote management features and require VPN access for any administrative session
• If the device is not business-critical, consider replacing it with a model that receives current vendor security maintenance

# Example: restrict administrative interface to a management subnet using iptables
# Adjust interface and CIDR to match the deployment
iptables -A INPUT -i eth0 -p tcp --dport 80 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 443 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j DROP