Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. Affected is the function change_wifi_password of the file /cgi-bin/adm.cgi. The manipulation of the argument wl_channel/wl_Pass/EncrypType leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
⚡ Remote command injection in Wavlink NU516U1 through change_wifi_password functionality enables full system compromise. #CVE #IoTSecurity #Exploit https://nvd.nist.gov/vuln/detail/CVE-2026-8188
Post summary
The tweet highlights a remote command‑injection vulnerability in a Wavlink router that could fully compromise the device, but it contains no proof of concept, exploit code, or patch information.
CVE-2026-8188 Remote OS Command Injection in Wavlink NU516U1 M16U1_V240425 WiFi ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-8188 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post announces CVE-2026-8188, a Remote OS Command Injection vulnerability affecting Wavlink NU516U1 routers, providing a link to VulMon for further details but no PoC, exploit, or patch information.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | wavlink | wl-nu516u1 | - | - | - |
| OS | wavlink | wl-nu516u1_firmware | m16u1_v240425 | - | - |