High severity · published Aug 3, 2026
CVE-2026-18587
Wavlink WL-NU516U1 Config Import os command injection
7.5
CVSS
2%
EPSS
No
On KEV
Description
A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been published and may be used. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WL
WL-NU516U1 · Wavlink
708c073-mt7628 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18587
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18587
dl.wavlink.com
https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin
github.com
https://github.com/oduoke567/WAVLINK-NU516U1-2026-05-1/blob/main/report.md
vuldb.com
https://vuldb.com/cve/CVE-2026-18587
vuldb.com
https://vuldb.com/submit/850494
vuldb.com
https://vuldb.com/vuln/385415
vuldb.com
https://vuldb.com/vuln/385415/cti
More from WL-NU516U1
9.8
CVE-2026-18589
Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow
9.8
CVE-2026-18588
Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow
9.8
CVE-2026-3703
Wavlink NU516U1 login.cgi sub_401A10 out-of-bounds write
9.8
CVE-2025-9149
Wavlink WL-NU516U1 wireless.cgi sub_4032E4 command injection
8.8
CVE-2026-8230
Wavlink NU516U1 login.cgi sys_login1 os command injection
