CVE-2026-15513: Wavlink WL-NU516U1 adm.cgi wlink_uci_set_value os command injection
A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlinkucisetvalue of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lanip results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wavlink WL-NU516U1 260515 (adm.cgi wlink_uci_set_value)to a version that resolves this vulnerability.Fixed in 260515 - Compensating control
Because the exploit can be initiated remotely and may be used publicly, restrict network access to the Wavlink device (e.g., only allow access from trusted IPs at the firewall/WAF) until the fixed version is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15513?
CVE-2026-15513 has a medium severity score of 6.3.
How does CVE-2026-15513 impact Wavlink WL-NU516U1?
CVE-2026-15513 allows for OS command injection through the wlink_uci_set_value function when manipulating the lan_ip argument.
Who can exploit CVE-2026-15513?
CVE-2026-15513 can be exploited remotely, allowing attackers to initiate the attack from anywhere.
What type of vulnerability is CVE-2026-15513 classified as?
CVE-2026-15513 is classified as an OS command injection vulnerability.
What is the potential impact of exploiting CVE-2026-15513?
Exploiting CVE-2026-15513 can lead to unauthorized command execution on the affected Wavlink device.