CVE-2026-8230: Wavlink WL-NU516U1 Firmware RCE Flaw

CVE-2026-8230 Overview

CVE-2026-8230 is an operating system (OS) command injection vulnerability affecting the Wavlink NU516U1 router running firmware version 240425. The flaw resides in the sys_login1 function within /cgi-bin/login.cgi, where the ipaddr argument is passed to an OS command without proper sanitization. Authenticated attackers can send a crafted request over the network to execute arbitrary shell commands on the device. The exploit has been publicly published, and the vendor was contacted prior to disclosure. The vulnerability is tracked under [CWE-77] and [CWE-78].

Critical Impact
Remote attackers with low privileges can inject arbitrary OS commands through the ipaddr parameter of the login CGI endpoint, compromising router integrity and confidentiality.

Affected Products

Wavlink WL-NU516U1 firmware version M16U1_V240425
Wavlink WL-NU516U1 hardware
/cgi-bin/login.cgisys_login1 function

Discovery Timeline

2026-05-10 - CVE-2026-8230 published to the National Vulnerability Database (NVD)
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-8230

Vulnerability Analysis

The vulnerability exists in the sys_login1 function defined in /cgi-bin/login.cgi on the Wavlink NU516U1 router. This CGI handler processes user-supplied parameters during the login flow. The ipaddr argument is passed into an OS command construction routine without proper input validation or sanitization. By embedding shell metacharacters into ipaddr, an attacker can break out of the intended argument context and append arbitrary commands.

Because the affected function executes within the router's web service context, injected commands typically run with elevated privileges on the embedded Linux environment. The exploitation requires network reachability to the device's HTTP interface and low-level credentials, as indicated by the PR:L vector component. Successful exploitation yields limited confidentiality, integrity, and availability impact on the device itself.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The sys_login1 handler concatenates the attacker-controlled ipaddr value into a shell command string and passes the result to a system-level execution function. No allowlist, escaping, or argument-array based invocation is performed.

Attack Vector

The attack vector is remote and network-based. An attacker authenticated to the router's web interface submits a POST request to /cgi-bin/login.cgi with a malicious ipaddr value containing shell separators such as ;, |, or backticks followed by attacker-chosen commands. The injected payload is then evaluated by the underlying shell. Public technical documentation of the issue is available in the GitHub Vulnerability Documentation and VulDB #362447.

No verified proof-of-concept code is reproduced here; refer to the external references for technical details.

Detection Methods for CVE-2026-8230

Indicators of Compromise

HTTP POST requests to /cgi-bin/login.cgi containing shell metacharacters (;, |, &, backticks, $()) in the ipaddr parameter.
Unexpected child processes spawned by the router's HTTP daemon, such as sh, wget, curl, tftp, or nc.
Outbound connections from the router to unknown hosts immediately following login.cgi requests.

Detection Strategies

Inspect web server and reverse proxy logs for ipaddr values that do not match a strict IPv4 or IPv6 syntax.
Deploy network intrusion detection signatures that flag requests to login.cgi containing command separators in form fields.
Correlate login.cgi POST events with subsequent DNS lookups or outbound HTTP traffic from the router.

Monitoring Recommendations

Capture and retain HTTP request bodies for management traffic targeting the router admin interface.
Alert on first-seen outbound destinations originating from network infrastructure devices.
Track firmware version inventory for WL-NU516U1 units running build M16U1_V240425.

How to Mitigate CVE-2026-8230

Immediate Actions Required

Restrict access to the router's management interface to trusted management VLANs and source IP ranges.
Rotate router administrator credentials and disable default accounts to limit the PR:L precondition.
Disable WAN-side access to /cgi-bin/login.cgi and other administrative CGI endpoints.

Patch Information

At the time of publication, no vendor advisory or fixed firmware build is referenced in the available data. Monitor the Wavlink support portal and the VulDB entry for CVE-2026-8230 for patch availability. Until a patched firmware release is available, treat affected devices as exposed.

Workarounds

Place affected routers behind a network firewall that blocks inbound HTTP/HTTPS to the management interface from untrusted networks.
Require VPN access for any remote administration of the router.
Replace end-of-support or unpatched Wavlink NU516U1 units with vendor-maintained equivalents if no fix is released.

bash

# Example firewall rule restricting access to the router admin interface
iptables -A INPUT -p tcp --dport 80  -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80  -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP