CVE-2025-10958: Wavlink NU516U1 AddMac wireless.cgi sub_403010 command injection

Published Sep 25, 2025

Updated

A flaw has been found in Wavlink NU516U1 M16U1V240425. Impacted is the function sub403010 of the file /cgi-bin/wireless.cgi of the component AddMac Page. This manipulation of the argument macAddr causes command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Wavlink NU516U1

Wavlink WL-NU516U1

Event History

Sep 25, 2025

CVE Published

via MITRE·05:32 PM

Data Sourced

via MITRE·05:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-10958?

CVE-2025-10958 is considered a high severity vulnerability due to the potential for remote command injection.

How do I fix CVE-2025-10958?

To remediate CVE-2025-10958, update the Wavlink NU516U1 to the latest firmware version provided by the vendor.

What component is affected by CVE-2025-10958?

CVE-2025-10958 affects the AddMac Page functionality in the /cgi-bin/wireless.cgi file of the Wavlink NU516U1.

Can CVE-2025-10958 be exploited remotely?

Yes, CVE-2025-10958 allows for remote exploitation of the vulnerable component.

What type of attack is associated with CVE-2025-10958?

CVE-2025-10958 is associated with command injection attacks that can occur due to improper handling of the macAddr argument.