CVE-2025-10960: Wavlink NU516U1 DeleteMac wireless.cgi sub_402D1C command injection

Published Sep 25, 2025

Updated

A vulnerability was found in Wavlink NU516U1 M16U1V240425. The impacted element is the function sub402D1C of the file /cgi-bin/wireless.cgi of the component DeleteMac Page. Performing manipulation of the argument deletelist results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Wavlink NU516U1

Wavlink WL-NU516U1

Event History

Sep 25, 2025

CVE Published

via MITRE·06:02 PM

Data Sourced

via MITRE·06:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-10960?

CVE-2025-10960 has a medium severity level due to the potential for command injection.

How do I fix CVE-2025-10960?

To fix CVE-2025-10960, update the Wavlink NU516U1 firmware to the latest version that addresses this vulnerability.

What type of attack is possible with CVE-2025-10960?

CVE-2025-10960 allows for command injection through manipulation of the delete_list argument.

What is the affected software for CVE-2025-10960?

CVE-2025-10960 affects the Wavlink NU516U1 device.

Where is CVE-2025-10960 located in the software?

CVE-2025-10960 is located in the /cgi-bin/wireless.cgi file within the DeleteMac Page functionality.