CVE-2026-8191: Wavlink NU516U1 adm.cgi wifi_region os command injection
A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-bin/adm.cgi. Such manipulation of the argument skiplist1/skiplist2 leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8191?
CVE-2026-8191 is classified as a critical severity vulnerability due to its potential for remote command execution.
How do I fix CVE-2026-8191?
To fix CVE-2026-8191, update to the latest firmware version provided by Wavlink that addresses this vulnerability.
What impact does CVE-2026-8191 have on affected devices?
CVE-2026-8191 allows attackers to execute arbitrary OS commands on the affected Wavlink NU516U1 device, compromising system integrity.
Who is affected by CVE-2026-8191?
CVE-2026-8191 affects users of the Wavlink NU516U1 router running the specific firmware version M16U1_V240425.
What are the potential exploits for CVE-2026-8191?
Exploiting CVE-2026-8191 can lead to unauthorized commands being executed on the underlying operating system, potentially allowing full system control.