CVE-2026-3612 | Wavlink WL-NU516U1 V240425 OTA Online Upgrade /cgi-bin/adm.cgi sub_405AF4 firmware_url command injection

A vulnerability has been found in Wavlink WL-NU516U1 V240425 and classified as critical. This affects the function sub_405AF4 of the file /cgi-bin/adm.cgi of the component OTA Online Upgrade. This manipulation of the argument firmware_url causes command injection.

The identification of this vulnerability is CVE-2026-3612. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure.