CVE-2026-8230: Wavlink NU516U1 login.cgi sys_login1 os command injection

Published May 10, 2026

Updated

A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

Affected Software

2 affected components

Wavlink NU516U1=240425

Wavlink WL-NU516U1

Event History

May 10, 2026

CVE Published

via MITRE·04:30 AM

Data Sourced

via MITRE·04:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 AM

DescriptionSeverityWeaknessAffected Software

May 11, 58342

Event

via FIRST·09:50 AM

Frequently Asked Questions

What is the severity of CVE-2026-8230?

CVE-2026-8230 is classified as a high-severity vulnerability due to its potential for remote code execution through os command injection.

How do I fix CVE-2026-8230?

To fix CVE-2026-8230, update the Wavlink NU516U1 to the latest firmware version that addresses this specific vulnerability.

What type of attack can exploit CVE-2026-8230?

CVE-2026-8230 can be exploited through os command injection, allowing attackers to execute arbitrary commands on the system.

What affected software is associated with CVE-2026-8230?

CVE-2026-8230 specifically affects the Wavlink NU516U1 device running version 240425.

What component of Wavlink NU516U1 is vulnerable in CVE-2026-8230?

The vulnerable component in CVE-2026-8230 is the function sys_login1 in the file /cgi-bin/login.cgi.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.