CVE-2025-10962: Wavlink NU516U1 SetName wireless.cgi sub_403198 command injection

Published Sep 25, 2025

Updated

A vulnerability was identified in Wavlink NU516U1 M16U1V240425. This impacts the function sub403198 of the file /cgi-bin/wireless.cgi of the component SetName Page. The manipulation of the argument mac5g leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

2 affected components

Wavlink NU516U1=M16U1_V240425

Wavlink WL-NU516U1

Event History

Sep 25, 2025

CVE Published

via MITRE·06:32 PM

Data Sourced

via MITRE·06:32 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-10962?

CVE-2025-10962 has a high severity due to its potential for remote command injection.

How do I fix CVE-2025-10962?

To fix CVE-2025-10962, update the Wavlink NU516U1 firmware to the latest version available from the manufacturer.

Who is affected by CVE-2025-10962?

CVE-2025-10962 affects users of the Wavlink NU516U1 device running the firmware version M16U1_V240425.

What type of vulnerability is CVE-2025-10962?

CVE-2025-10962 is a command injection vulnerability that allows attackers to execute arbitrary commands on the affected device.

Can CVE-2025-10962 be exploited remotely?

Yes, CVE-2025-10962 can be exploited remotely, allowing attackers to initiate the attack from anywhere.