CVE-2026-8192 Wavlink CVE debrief

Who should care

Administrators and security teams responsible for Wavlink NU516U1 M16U1_V240425 devices, especially if the web management interface is reachable from untrusted networks. Internet-exposed appliances and environments that rely on these devices for edge connectivity should treat this as a priority review item.

Technical summary

The source description reports unsafe handling of attacker-controlled EncrypType/wl_Pass input in the wzdap function of /cgi-bin/adm.cgi, resulting in OS command injection. The CNA metadata associated with the NVD record classifies the issue under CWE-77 and CWE-78. The record was received by NVD on 2026-05-09, and the supplied description states that the vendor was contacted early and that a public exploit exists.

Defensive priority

Medium. The published CVSS severity is low, but the issue is described as remotely reachable and publicly exploitable. Prioritize validation and mitigation for any device that is exposed to the internet or accessible from less-trusted networks.

Recommended defensive actions

• Identify whether any Wavlink NU516U1 M16U1_V240425 devices are deployed in your environment.
• Check whether the management interface at /cgi-bin/adm.cgi is reachable from the internet or broad internal networks.
• Restrict administrative access to trusted management networks only, and remove unnecessary external exposure.
• Apply the vendor's remediation guidance or firmware updates once available through official channels.
• If you cannot patch immediately, disable or tightly firewall the affected management interface and monitor for suspicious web-admin activity.
• Review logs and configuration changes for signs of unexpected command execution or unauthorized admin actions.
• Treat any public-facing instance as higher risk because the supplied disclosure notes a public exploit.

Evidence notes

All statements above are limited to the supplied source corpus and the linked official/reference records. The NVD-sourced metadata shows the CVE as received on 2026-05-09 with CNA references to a GitHub writeup and Vuldb pages. The provided description explicitly names Wavlink NU516U1 M16U1_V240425, the /cgi-bin/adm.cgi wzdap function, attacker-controlled EncrypType/wl_Pass input, remote attack potential, and public exploit availability. No KEV entry was supplied.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.