Is CVE-2026-8189 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8189 being exploited in the wild.

How severe is CVE-2026-8189?

Medium severity, with a CVSS score of 6.3, published 9 May 2026.

Which products and versions are affected?

Wavlink NU516U1 M16U1_V240425; Wavlink NU516U1 firmware M16U1_V240425.

Is there a fix for CVE-2026-8189?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8189 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8189?

Check whether you run Wavlink NU516U1, Wavlink NU516U1 firmware, Wavlink Wl-Nu516u1 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8189: Wavlink NU516U1 OS command injection in adm.cgi

CVE-2026-8189 · Severity: medium · CVSS 6.3 · Published 2026-05-09

A vulnerability exists in the Wavlink NU516U1 USB Network Printer Server, a device used to share printers across a local network. An attacker can exploit this flaw to take complete control of the device by executing unauthorized system commands. This could lead to the interception of print jobs, unauthorized access to the local network, or the use of the device as a foothold for further attacks.

Technologies: Wavlink NU516U1, Wavlink NU516U1 firmware, Wavlink Wl-Nu516u1, Wavlink Wl-Nu516u1 Firmware. Vendors: Wavlink.

Quick answers

Is CVE-2026-8189 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8189 being exploited in the wild.
How severe is CVE-2026-8189?: Medium severity, with a CVSS score of 6.3, published 9 May 2026.
Which products and versions are affected?: Wavlink NU516U1 M16U1_V240425; Wavlink NU516U1 firmware M16U1_V240425.
Is there a fix for CVE-2026-8189?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8189 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8189?: Check whether you run Wavlink NU516U1, Wavlink NU516U1 firmware, Wavlink Wl-Nu516u1 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the Wavlink NU516U1 USB Network Printer Server running firmware version M16U1_V240425. The flaw is located within the 'wzdrepeater' function of the '/cgi-bin/adm.cgi' component. Specifically, the application fails to properly sanitize the 'wlan_bssid', 'sel_Automode', and 'sel_EncrypTyp' parameters before passing them to a system shell. A remote attacker with low privileges can exploit this by sending a crafted HTTP POST request containing shell metacharacters (e.g., using $() syntax) to execute arbitrary OS commands with the privileges of the web server. A public proof-of-concept demonstrates achieving a remote shell via telnetd.

Affected products

Wavlink NU516U1 (WL-NU516U1) M16U1_V240425

Timeline

2026-05-09: disclosed: Initial disclosure and VulDB entry creation
2026-05-09: advisory: CVE-2026-8189 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.