CVE-2026-8191 | Wavlink NU516U1 M16U1_V240425 /cgi-bin/adm.cgi wifi_region skiplist1/skiplist2 os command injection

A vulnerability categorized as critical has been discovered in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-bin/adm.cgi. Such manipulation of the argument skiplist1/skiplist2 leads to os command injection.

This vulnerability is uniquely identified as CVE-2026-8191. The attack can be launched remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure.