PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8190 Vuldb CVE debrief

CVE-2026-8190 describes a command-injection issue in the Wavlink NU516U1 M16U1_V240425 WAN handling path. The source says attacker-controlled values in /cgi-bin/adm.cgi can reach OS command execution, and that the exploit has been publicly disclosed. Even though the supplied CVSS score is low, internet-exposed devices should be treated carefully because the attack surface is remote and administrative.

Vendor
Vuldb
Product
Unknown
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-09
Original CVE updated
2026-07-24
Advisory published
2026-05-09
Advisory updated
2026-07-24

Who should care

Administrators and owners of Wavlink NU516U1 devices running M16U1_V240425, especially systems exposed to the internet or reachable from untrusted networks. Security teams supporting small-office/home-office routers and edge appliances should also review this issue.

Technical summary

The supplied description ties the issue to the wan function in /cgi-bin/adm.cgi. The parameters ppp_username, ppp_passwd, rwan_ip, rwan_mask, and rwan_gateway are described as being passed in a way that allows OS command injection. The NVD record also lists CWE-77 and CWE-78, consistent with command-injection weakness classes, and notes a public disclosure via the cited references.

Defensive priority

Medium for most environments; elevated for any internet-exposed or broadly reachable Wavlink NU516U1 deployment.

Recommended defensive actions

  • Identify any Wavlink NU516U1 devices and confirm whether they run M16U1_V240425.
  • Restrict access to administrative and WAN-facing management interfaces to trusted networks only.
  • Review the referenced vendor and NVD materials for any fixed firmware or mitigation guidance.
  • Monitor affected devices for unexpected configuration changes or signs of command execution.
  • If remediation is unavailable, isolate the device behind segmentation or replace it with a supported model.

Evidence notes

The CVE was published and modified on 2026-05-09T18:16:22.293Z. The supplied description states that /cgi-bin/adm.cgi wan handling can be manipulated through ppp_username, ppp_passwd, rwan_ip, rwan_mask, and rwan_gateway to cause OS command injection, and that the exploit has been publicly disclosed. The NVD metadata lists Vuldb-sourced references, a GitHub-hosted writeup, and Vuldb advisory pages, and classifies the weakness with CWE-77 and CWE-78.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8190 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8190

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8190 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8190

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.