Medium severity · published Jun 29, 2026
CVE-2026-13538
Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_401D68 command injection
6.3
CVSS
2.2%
EPSS
No
On KEV
Description
A vulnerability was determined in Wavlink WL-NU516U1-A M16U1_V240425. The affected element is the function sub_401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SSID5G2/AuthMethod2/WPAPSK12 causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WL
WL-NU516U1-A · Wavlink
M16U1_V240425 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13538
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13538
dl.wavlink.com
https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin
github.com
https://github.com/Svigo-o/Wavlink_vul/tree/main/wavlink-wl-nu516u1-wireless-multissid-ssid2g2-command-injection
github.com
https://github.com/Svigo-o/Wavlink_vul/tree/main/wavlink-wl-nu516u1-wireless-multissid-ssid5g2-command-injection
vuldb.com
https://vuldb.com/cve/CVE-2026-13538
vuldb.com
https://vuldb.com/submit/834019
vuldb.com
https://vuldb.com/submit/834021
More from WL-NU516U1-A
8.8
CVE-2026-13539
Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_407504 stack-based overflow