CVE-2026-18589Disclosure

LOWCVSS 8.9 · HIGH

Exploit discussion active in current signal (3 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be used. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-119CWE-121

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

Public PoC is present in monitored signal
3 mentions across 1 observed day

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets3 URLs

By indicator

Full discourse3 posts

Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-18589 A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1P… https://www.cve.org/CVERecord?id=CVE-2026-18589 ----- Traducción: Se encontró una vu… http://infoflow.cloud`
Post summary
A new CVE was disclosed for a Wavlink router vulnerability affecting the change_password function; the post provides technical details but no PoC, exploit, patch, or active exploitation information.
0000030
96 followersView on X
CVE@CVEnew91d
General
CVE-2026-18589 A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1P… https://www.cve.org/CVERecord?id=CVE-2026-18589
Post summary
The post references CVE-2026-18589, noting it impacts a password change function in a Wavlink device, but offers only minimal technical detail and no actionable info.
00000768
57.9K followersView on X
SecAlerts@SecAlertsCo91d
Disclosure
💾 Wavlink WL-NU516U1 NAS: stack-based overflow in nas.cgi change_password (User1Passwd arg) — no auth, network-exploitable, CVSS 9.8. CVE-2026-18589 has a public exploit. Check your NAS exposure now. #cybersecurity #ciso #vulnerabilities #mssp https://secalerts.co/vulnerability/CVE-2026-18589?utm_campaign=x https://t.co/meFl6JTnjE
Post summary
A new stack-based overflow in Wavlink NAS devices (CVE‑2026‑18589) is publicly exploitable with a CVSS of 9.8; users are urged to check exposure and apply fixes promptly.
00000172
871 followersView on X

Explore more

Back to dashboard