CVE-2026-8192: Wavlink NU516U1 adm.cgi wzdap os command injection
A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. This vulnerability affects the function wzdap of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument EncrypType/wl_Pass is directly passed by the attacker/so we can control the EncrypType/wl_Pass results in os command injection. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8192?
CVE-2026-8192 is considered a high severity vulnerability due to its potential for remote command execution.
How do I fix CVE-2026-8192?
To mitigate CVE-2026-8192, ensure that you update the Wavlink NU516U1 device to the latest firmware version that addresses this vulnerability.
What aspect of CVE-2026-8192 is vulnerable?
CVE-2026-8192 specifically involves an OS command injection in the wzdap function found in the adm.cgi file.
Who is affected by CVE-2026-8192?
Users of the Wavlink NU516U1 with firmware version M16U1_V240425 are affected by CVE-2026-8192.
Can CVE-2026-8192 lead to data loss?
Yes, CVE-2026-8192 can lead to data loss or unauthorized access due to the command injection vulnerability.