A critical command injection vulnerability in the Wavlink WL-NU516U1 firmware poses a severe risk of unauthorized system control.

This is an OS command injection vulnerability, categorized under CWE-78 and CWE-77. It allows remote, unauthenticated attackers to achieve full compromise of the affected device.

Successful exploitation allows an attacker to gain full control over the device, leading to potential data theft, lateral movement within the network, or complete system takeover. The CVSS score of 7.5 highlights the high impact on confidentiality, integrity, and availability.

Immediate Action: Update the device firmware to the version provided by the vendor (WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628-squashfs-sysupgrade.bin).

Proactive Monitoring: Review device management interfaces and system logs for suspicious command execution patterns or unauthorized configuration changes.

Compensating Controls: Utilize a Web Application Firewall or network access control lists to block malicious payloads targeting the device management interface.

Public Exploit Available: Yes, a proof-of-concept report is available on GitHub (oduoke567 repository).

This vulnerability carries a severe risk due to the potential for full system compromise. Users of the affected Wavlink hardware must apply the provided firmware update immediately to prevent unauthorized access.