Is CVE-2026-8190 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8190 being exploited in the wild.

How severe is CVE-2026-8190?

Medium severity, with a CVSS score of 6.3, published 9 May 2026.

Which products and versions are affected?

Wavlink NU516U1 firmware M16U1_V240425; Wavlink NU516U1 USB Network Printer Server M16U1_V240425.

Is there a fix for CVE-2026-8190?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8190 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8190?

Check whether you run Wavlink NU516U1 firmware, Wavlink NU516U1 USB Network Printer Server, Wavlink Wl-Nu516u1 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8190: Wavlink NU516U1 OS command injection in adm.cgi

CVE-2026-8190 · Severity: medium · CVSS 6.3 · Published 2026-05-09

A vulnerability exists in the Wavlink NU516U1 USB Network Printer Server, a device used to share printers across a network. An attacker can exploit this flaw to take complete control of the device, potentially leading to unauthorized access to network traffic or using the device as a foothold for further attacks. This could result in a total loss of confidentiality and service availability for the affected hardware.

Technologies: Wavlink NU516U1 firmware, Wavlink Wl-Nu516u1, Wavlink Wl-Nu516u1 Firmware. Vendors: Wavlink.

Quick answers

Is CVE-2026-8190 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8190 being exploited in the wild.
How severe is CVE-2026-8190?: Medium severity, with a CVSS score of 6.3, published 9 May 2026.
Which products and versions are affected?: Wavlink NU516U1 firmware M16U1_V240425; Wavlink NU516U1 USB Network Printer Server M16U1_V240425.
Is there a fix for CVE-2026-8190?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8190 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8190?: Check whether you run Wavlink NU516U1 firmware, Wavlink NU516U1 USB Network Printer Server, Wavlink Wl-Nu516u1 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability exists in the 'wan' function of the /cgi-bin/adm.cgi component in Wavlink NU516U1 firmware version M16U1_V240425. The issue stems from improper neutralization of special elements in several parameters, including ppp_username, ppp_passwd, rwan_ip, rwan_mask, and rwan_gateway. A remote attacker with low privileges can exploit this by sending a crafted POST request containing shell metacharacters (e.g., using $() syntax) to execute arbitrary commands on the underlying operating system. A public proof-of-concept demonstrates achieving a remote shell via telnetd. While the vendor was contacted, no official patch has been confirmed in the advisory.

Affected products

Wavlink NU516U1 Firmware M16U1_V240425

Timeline

2026-05-09: disclosed: Vulnerability disclosed via VulDB and GitHub PoC
2026-05-09: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.