CVE-2026-8227: Wavlink NU516U1 adm.cgi wzdapMesh os command injection

Published May 10, 2026

Updated

A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

Affected Software

2 affected components

Wavlink NU516U1=240425

Wavlink WL-NU516U1

Event History

May 10, 2026

CVE Published

via MITRE·03:45 AM

Data Sourced

via MITRE·03:45 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 AM

DescriptionSeverityWeaknessAffected Software

Nov 17, 58336

Event

via FIRST·04:04 PM

Frequently Asked Questions

What is the severity of CVE-2026-8227?

CVE-2026-8227 has been classified as a high severity vulnerability due to its potential for remote exploitation through os command injection.

How do I fix CVE-2026-8227?

To mitigate CVE-2026-8227, it is recommended to update to the latest firmware version for the Wavlink NU516U1 router.

Who is affected by CVE-2026-8227?

CVE-2026-8227 affects the Wavlink NU516U1 router version 240425, specifically targeting its wzdapMesh function.

What type of vulnerability is CVE-2026-8227?

CVE-2026-8227 is an os command injection vulnerability that allows remote attackers to execute arbitrary commands on the affected device.

Can CVE-2026-8227 be exploited remotely?

Yes, CVE-2026-8227 can be exploited remotely, allowing attackers to manipulate the vulnerable wzdapMesh function from an external network.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.