CVE-2026-18590 | Wavlink WL-NU516U1 708c073-mt7628 Admin Password adm.cgi set_sys_adm os command injection

A vulnerability marked as critical has been reported in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection.

This vulnerability is tracked as CVE-2026-18590. The attack is possible to be carried out remotely. Moreover, an exploit is present.

It is suggested to upgrade the affected component.

The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.