CVE-2026-8192: Wavlink WL-NU516U1 Firmware RCE Flaw

CVE-2026-8192 Overview

CVE-2026-8192 is an operating system (OS) command injection vulnerability in the Wavlink WL-NU516U1 router running firmware version M16U1_V240425. The flaw resides in the wzdap function of the /cgi-bin/adm.cgi endpoint. Attacker-controlled values supplied through the EncrypType and wl_Pass parameters are passed directly to a shell context without sanitization. Authenticated remote attackers can inject arbitrary shell commands that execute on the device. Public exploit details have been released, increasing the likelihood of opportunistic targeting against exposed devices. The vendor was contacted prior to disclosure.

Critical Impact

Authenticated remote attackers can execute arbitrary operating system commands on affected Wavlink routers, providing a foothold on the network perimeter.

Affected Products

• Wavlink WL-NU516U1 (hardware)
• Wavlink WL-NU516U1 Firmware M16U1_V240425
• /cgi-bin/adm.cgi administrative interface (wzdap function)

Discovery Timeline

• 2026-05-09 - CVE-2026-8192 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-8192

Vulnerability Analysis

The vulnerability is an OS command injection flaw classified under [CWE-77]. The wzdap handler within /cgi-bin/adm.cgi processes wireless configuration parameters submitted by authenticated users. The EncrypType and wl_Pass arguments flow into a system shell invocation without input validation or argument escaping. An attacker supplying shell metacharacters such as backticks, semicolons, or $(...) substitutions can break out of the intended command context. Injected commands execute with the privilege level of the web server process, which on embedded Wavlink devices is typically root. The exploit prediction score (EPSS) at publication was approximately 0.35%, placing the issue in the 57th percentile of likely exploitation.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. The wzdap function constructs a shell command string by concatenating user-controlled HTTP request parameters. Because the firmware lacks an allow-list filter or safe execution wrapper such as execve with separated arguments, any shell metacharacter passes through to /bin/sh. This pattern is common in MIPS-based small office and home office (SOHO) router firmware where vendors invoke system() for convenience.

Attack Vector

Exploitation requires network reachability to the device administrative interface and low-privilege authentication. The attacker sends a crafted HTTP request to /cgi-bin/adm.cgi invoking the wzdap function with malicious payloads in the EncrypType or wl_Pass form fields. The injected shell command runs in the context of the embedded web server. Successful exploitation can lead to credential theft, persistent backdoor installation, traffic interception, and lateral movement into the local area network (LAN).

No verified proof-of-concept code is included in this advisory. Technical details and a reproduction walkthrough are available in the GitHub Vulnerability Report and the VulDB entry #362344.

Detection Methods for CVE-2026-8192

Indicators of Compromise

• HTTP POST requests to /cgi-bin/adm.cgi containing shell metacharacters (;, |, `, $(, &&) within the EncrypType or wl_Pass parameters.
• Unexpected outbound connections originating from the router management interface to attacker-controlled infrastructure.
• New or modified entries in router startup scripts, cron tables, or /tmp indicating persistence implants.
• Unauthorized changes to wireless configuration or administrator credentials.

Detection Strategies

• Inspect web access logs on the router or upstream proxy for adm.cgi requests with non-printable or metacharacter content in wireless parameter fields.
• Deploy network intrusion detection signatures that flag HTTP request bodies containing shell injection patterns targeting the wzdap endpoint.
• Baseline router CPU, memory, and outbound flow data to identify deviations consistent with malware execution.

Monitoring Recommendations

• Forward router syslog and HTTP access logs to a centralized log platform for retention and correlation.
• Monitor for authentication events to the router administrative interface from unexpected source addresses, including WAN-side connections.
• Alert on DNS queries from the router itself, which is unusual behavior outside of firmware update checks.

How to Mitigate CVE-2026-8192

Immediate Actions Required

• Restrict access to the router administrative interface to trusted management subnets only and disable WAN-side administration.
• Rotate the administrator password and any wireless pre-shared keys following confirmed exposure.
• Audit the device for unauthorized configuration changes, scheduled tasks, or modified firmware components.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry or VulDB submission. Affected operators should monitor the Wavlink support site for an updated firmware release superseding M16U1_V240425. Until a fix is available, treat the device as exposed and apply compensating network controls.

Workarounds

• Place the router behind a network segment that blocks untrusted hosts from reaching /cgi-bin/adm.cgi.
• Disable remote management features and any UPnP or port-forwarding rules that expose the management interface to the internet.
• Where feasible, replace the affected device with a vendor-supported model that receives current security updates.

# Example: block external access to the router admin interface using iptables on an upstream gateway
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80 ! -s 10.0.0.0/24 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 ! -s 10.0.0.0/24 -j DROP