CVE-2026-8228: Wavlink NU516U1 wireless.cgi advance os command injection
A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlan_conf/Channel/skiplist/ieee_80211h leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8228?
CVE-2026-8228 has a high severity due to the potential for OS command injection, which can allow attackers to execute arbitrary commands on the affected device.
How do I fix CVE-2026-8228?
To fix CVE-2026-8228, update the Wavlink NU516U1 to a version that addresses the vulnerability as provided by the vendor.
What devices are affected by CVE-2026-8228?
Only the Wavlink NU516U1 device version 240425 is affected by CVE-2026-8228.
What type of attack can exploit CVE-2026-8228?
CVE-2026-8228 can be exploited through an OS command injection attack that manipulates certain parameters in the wireless.cgi file.
What is the impact of CVE-2026-8228?
The impact of CVE-2026-8228 can result in unauthorized command execution on the Wavlink NU516U1 device, potentially compromising the system's integrity.