An incomplete security patch in the Wavlink WL-NU516U1 firmware allows authenticated attackers to perform remote command injection, potentially leading to full device compromise.

This is a command injection vulnerability (CWE-77) located in the singlePortForwardDelete function of the firewall.cgi script. An authenticated remote attacker can bypass a flawed blacklist filter by using a semicolon character in the del_flag parameter to inject arbitrary shell commands, which are then executed with root privileges.

Successful exploitation grants an attacker administrative control over the affected network device. This can lead to unauthorized access to internal network traffic, lateral movement within the environment, and complete loss of confidentiality, integrity, and availability of the affected system. Given the CVSS score of 7.2, this vulnerability represents a significant risk to network security, especially in environments where administrative credentials for these devices may be known or easily guessed.

Immediate Action: As no official patch is currently available from the vendor, restrict management access to the device to trusted internal networks only. If possible, disable the affected firewall management features until a firmware update is released.

Proactive Monitoring: Monitor device logs for anomalous POST requests to the /cgi-bin/firewall.cgi endpoint, specifically looking for unusual characters or command strings within the del_flag parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) or implement network-level ingress filtering to block requests containing semicolon characters or suspicious command patterns directed at the device's management interface.

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's technical write-up on GitHub.

Given the confirmed existence of a functional proof-of-concept and the nature of the flaw, organizations utilizing the Wavlink WL-NU516U1 should treat this as a high-priority risk. Immediately isolate the management interface of these devices from the public internet and enforce strict access controls. Monitor for vendor updates closely, as this vulnerability stems from an incomplete fix of a previous issue and requires a more robust sanitization implementation to resolve.