CVE-2025-10961: Wavlink NU516U1 Delete_Mac_list wireless.cgi sub_4030C0 command injection

Published Sep 25, 2025

Updated

A vulnerability was determined in Wavlink NU516U1 M16U1V240425. This affects the function sub4030C0 of the file /cgi-bin/wireless.cgi of the component DeleteMaclist Page. Executing manipulation of the argument deletelist can lead to command injection. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Wavlink NU516U1

Wavlink WL-NU516U1

Event History

Sep 25, 2025

CVE Published

via MITRE·06:02 PM

Data Sourced

via MITRE·06:02 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-10961?

CVE-2025-10961 is classified as a high severity vulnerability due to its potential for command injection.

How do I fix CVE-2025-10961?

To mitigate CVE-2025-10961, update the Wavlink NU516U1 device firmware to the latest version provided by the vendor.

What type of vulnerability is CVE-2025-10961?

CVE-2025-10961 is a command injection vulnerability found in the Delete_Mac_list page of Wavlink NU516U1.

Where is CVE-2025-10961 located in the software?

CVE-2025-10961 is located in the function sub_4030C0 of the /cgi-bin/wireless.cgi file of the Wavlink NU516U1.

Which devices are affected by CVE-2025-10961?

CVE-2025-10961 affects the Wavlink NU516U1 model specifically.