CVE-2026-3613: Wavlink WL-NU516U1 login.cgi sub_401A0C stack-based overflow
A vulnerability was identified in Wavlink WL-NU516U1 V240425. This vulnerability affects the function sub401A0C of the file /cgi-bin/login.cgi. Such manipulation of the argument ipaddr leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3613?
CVE-2026-3613 is classified as a high severity vulnerability due to its potential for exploitation via stack-based buffer overflow.
How do I fix CVE-2026-3613?
The recommended fix for CVE-2026-3613 is to update the Wavlink WL-NU516U1 to the latest firmware version that addresses this vulnerability.
What impact does CVE-2026-3613 have on users?
CVE-2026-3613 can potentially allow attackers to execute arbitrary code on the affected device, compromising user data and network security.
What causes CVE-2026-3613?
CVE-2026-3613 is caused by improper handling of the 'ipaddr' argument within the 'sub_401A0C' function in the 'login.cgi' script, leading to a buffer overflow.
Is CVE-2026-3613 a widespread vulnerability?
CVE-2026-3613 specifically affects Wavlink WL-NU516U1 devices, so its widespread impact is limited to users of this particular model.