CVE-2026-3661 | Wavlink WL-NU516U1 240425 /cgi-bin/adm.cgi ota_new_upgrade model command injection

A vulnerability marked as critical has been reported in Wavlink WL-NU516U1 240425. This affects the function ota_new_upgrade of the file /cgi-bin/adm.cgi. This manipulation of the argument model causes command injection.

The identification of this vulnerability is CVE-2026-3661. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure.