CVE-2026-13539: Wavlink WL-NU516U1-A POST Parameter wireless.cgi sub_407504 stack-based overflow
A vulnerability was identified in Wavlink WL-NU516U1-A M16U1V240425. The impacted element is the function sub407504 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. Such manipulation of the argument Guestssid leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wavlink WL-NU516U1-Ato a version that resolves this vulnerability.Fixed in M16U1_V240425 - Compensating control
Because the issue allows remote exploitation of the /cgi-bin/wireless.cgi (sub_407504) via the Guest_ssid argument, restrict network access to the router’s CGI/interface that serves POST Parameter Handler (wireless.cgi) so it is not reachable from untrusted networks.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13539?
CVE-2026-13539 has a severity rating of high with a score of 8.8.
How do I fix CVE-2026-13539?
To fix CVE-2026-13539, update the Wavlink WL-NU516U1-A device to the latest firmware version provided by the manufacturer.
What type of vulnerability is CVE-2026-13539?
CVE-2026-13539 is a stack-based buffer overflow vulnerability affecting the POST Parameter Handler of Wavlink WL-NU516U1-A.
What could be the impact of exploiting CVE-2026-13539?
Exploiting CVE-2026-13539 could lead to remote code execution and compromise the affected device.
Which component is affected by CVE-2026-13539?
CVE-2026-13539 affects the sub_407504 function in the /cgi-bin/wireless.cgi file of the Wavlink WL-NU516U1-A.