CVE-2026-8192 | Wavlink NU516U1 M16U1_V240425 /cgi-bin/adm.cgi wzdap os command injection

A vulnerability identified as critical has been detected in Wavlink NU516U1 M16U1_V240425. This vulnerability affects the function wzdap of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument EncrypType/wl_Pass is directly passed by the attacker/so we can control the EncrypType/wl_Pass results in os command injection.

This vulnerability was named CVE-2026-8192. The attack may be initiated remotely. In addition, an exploit is available.

The vendor was contacted early about this disclosure.