CVE-2026-2565: Wavlink WL-NU516U1 adm.cgi sub_40785C stack-based overflow
A weakness has been identified in Wavlink WL-NU516U1 20251208. Affected by this issue is the function sub40785C of the file /cgi-bin/adm.cgi. This manipulation of the argument timezone causes stack-based buffer overflow. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2565?
CVE-2026-2565 is classified as a high severity vulnerability due to the potential for remote code execution through stack-based buffer overflow.
How do I fix CVE-2026-2565?
To fix CVE-2026-2565, it is recommended to update the Wavlink WL-NU516U1 firmware to the latest version provided by the vendor.
What type of vulnerability is CVE-2026-2565?
CVE-2026-2565 is a stack-based buffer overflow caused by improper handling of the time_zone parameter in the adm.cgi script.
Who is affected by CVE-2026-2565?
CVE-2026-2565 affects users of the Wavlink WL-NU516U1 device, specifically those running firmware version released prior to 20251208.
What can an attacker achieve with CVE-2026-2565?
An attacker can exploit CVE-2026-2565 to execute arbitrary code on the affected device, potentially compromising the system.