CVE-2026-2615: Wavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injection
A flaw has been found in Wavlink WL-NU516U1 up to 20251208. The affected element is the function singlePortForwardDelete of the file /cgi-bin/firewall.cgi. Executing a manipulation of the argument delflag can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2615?
CVE-2026-2615 is categorized as a medium severity vulnerability due to the potential for command injection.
How do I fix CVE-2026-2615?
To mitigate CVE-2026-2615, update the Wavlink WL-NU516U1 firmware to a version beyond 20251208.
What impact does CVE-2026-2615 have on my device?
CVE-2026-2615 allows attackers to perform unauthorized command execution through the singlePortForwardDelete function.
Which versions of Wavlink WL-NU516U1 are affected by CVE-2026-2615?
Wavlink WL-NU516U1 versions up to and including 20251208 are affected by CVE-2026-2615.
What is the nature of the vulnerability in CVE-2026-2615?
CVE-2026-2615 is a command injection vulnerability that exploits improper handling of the del_flag argument in the firewall.cgi file.