Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
CVE-2026-8230 A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argumen… https://www.cve.org/CVERecord?id=CVE-2026-8230
Post summary
A flaw has been identified in the Wavlink NU516U1 device affecting the sys_login1 function in /cgi-bin/login.cgi; no exploit, patch, or active exploitation details are provided.
⚠️ CVE-2026-8230 in Wavlink NU516U1 is under active exploitation, allowing attackers to inject OS commands via login.cgi. This could lead to full system compromise. Patch now to protect your systems. #NerdieNews #CyberSecurity #InfoSec #Vulnerability https://t.co/keIuKchbGJ
Post summary
CVE-2026-8230 in Wavlink NU516U1 is reportedly being actively exploited in the wild, enabling OS command injection via login.cgi. A patch is available to mitigate the risk.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | wavlink | wl-nu516u1 | - | - | - |
| OS | wavlink | wl-nu516u1_firmware | m16u1_v240425 | - | - |