CVE-2026-8190 | Wavlink NU516U1 M16U1_V240425 /cgi-bin/adm.cgi wan os command injection

A vulnerability was found in Wavlink NU516U1 M16U1_V240425. It has been rated as critical. Affected by this issue is the function wan of the file /cgi-bin/adm.cgi. This manipulation of the argument ppp_username/ppp_passwd/rwan_ip/rwan_mask/rwan_gateway is directly passed by the attacker/so we can control the ppp_username/ppp_passwd/rwan_ip/rwan_mask/rwan_gateway causes os command injection.

This vulnerability is handled as CVE-2026-8190. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure.