Executive brief
A vulnerability exists in the Wavlink WL-NU516U1-A printer server that allows an attacker to execute unauthorized commands on the device. By sending specially crafted network requests to the device's wireless configuration interface, an attacker could gain control over the system, potentially leading to data theft or service disruption. A fixed firmware version has been released by the manufacturer to address this issue.
Technical details
A command injection vulnerability exists in the 'sub_401D68' function within '/cgi-bin/wireless.cgi' of Wavlink WL-NU516U1-A firmware version M16U1_V240425. The issue stems from improper neutralization of special elements in POST parameters such as SSID2G2, SSID5G2, AuthMethod2, and WPAPSK12. While the application implements a filter (sub_4074A0) to block backticks and pipes, it fails to sanitize '$()' command substitution syntax. An authenticated remote attacker can exploit this by submitting a crafted POST request, which is then concatenated into a shell command via 'sprintf' and executed using 'system()'. A patched firmware version (WINSTAR_NU516U1-WO-A-2026-06-22) is available.
Affected products
- Wavlink WL-NU516U1-A M16U1_V240425
Timeline
- 2026-06-22: patched: Fixed firmware version released by vendor.
- 2026-06-29: advisory: Vulnerability disclosed and CVE assigned.
References
- https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-06-22-5ccde97-mt7628-squashfs-sysupgrade.bin
- https://github.com/Svigo-o/Wavlink_vul/tree/main/wavlink-wl-nu516u1-wireless-multissid-ssid2g2-command-injection
- https://github.com/Svigo-o/Wavlink_vul/tree/main/wavlink-wl-nu516u1-wireless-multissid-ssid5g2-command-injection
- https://vuldb.com/cve/CVE-2026-13538
- https://vuldb.com/submit/834019
- https://vuldb.com/submit/834021
- https://vuldb.com/submit/834022