Is CVE-2026-8188 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8188 being exploited in the wild.

How severe is CVE-2026-8188?

Medium severity, with a CVSS score of 6.3, published 9 May 2026.

Which products and versions are affected?

Wavlink NU516U1 M16U1_V240425; Wavlink NU516U1 firmware M16U1_V240425.

Is there a fix for CVE-2026-8188?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8188 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8188?

Check whether you run Wavlink NU516U1, Wavlink NU516U1 firmware, Wavlink Wl-Nu516u1 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8188: Wavlink NU516U1 command injection in change_wifi_password

CVE-2026-8188 · Severity: medium · CVSS 6.3 · Published 2026-05-09

A vulnerability exists in the Wavlink NU516U1 USB Network Printer Server, a device used to share printers across a network. An attacker can exploit this flaw to take complete control of the device by executing unauthorized system commands. This could lead to the interception of print jobs, unauthorized access to the local network, or the use of the device as a foothold for further attacks.

Technologies: Wavlink NU516U1, Wavlink NU516U1 firmware, Wavlink Wl-Nu516u1, Wavlink Wl-Nu516u1 Firmware. Vendors: Wavlink.

Quick answers

Is CVE-2026-8188 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8188 being exploited in the wild.
How severe is CVE-2026-8188?: Medium severity, with a CVSS score of 6.3, published 9 May 2026.
Which products and versions are affected?: Wavlink NU516U1 M16U1_V240425; Wavlink NU516U1 firmware M16U1_V240425.
Is there a fix for CVE-2026-8188?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8188 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8188?: Check whether you run Wavlink NU516U1, Wavlink NU516U1 firmware, Wavlink Wl-Nu516u1 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the 'change_wifi_password' function within the '/cgi-bin/adm.cgi' component of Wavlink NU516U1 firmware version M16U1_V240425. The root cause is the improper neutralization of special elements in the 'wl_channel', 'wl_Pass', and 'EncrypType' parameters, which are passed directly to system shells. A remote attacker with low privileges (authenticated access to the web interface) can submit a crafted POST request containing shell metacharacters (e.g., backticks) to execute arbitrary commands as the root user. A public proof-of-concept demonstrates using this flaw to start a telnet daemon for remote shell access.

Affected products

Wavlink NU516U1 M16U1_V240425

Timeline

2026-05-09: disclosed: Vulnerability disclosed to the public
2026-05-09: advisory: Initial advisory published by VulDB

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.