CVE-2026-3661: Wavlink WL-NU516U1 adm.cgi ota_new_upgrade command injection
A flaw has been found in Wavlink WL-NU516U1 240425. This affects the function otanewupgrade of the file /cgi-bin/adm.cgi. This manipulation of the argument model causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3661?
CVE-2026-3661 is classified as a high severity vulnerability due to its potential for remote command injection.
How do I fix CVE-2026-3661?
To fix CVE-2026-3661, upgrade to the latest firmware version provided by Wavlink that addresses this command injection flaw.
What systems are affected by CVE-2026-3661?
CVE-2026-3661 affects the Wavlink WL-NU516U1 model specifically due to a vulnerability in the ota_new_upgrade function.
Can CVE-2026-3661 be exploited remotely?
Yes, CVE-2026-3661 can be exploited remotely, allowing attackers to inject commands through vulnerable input.
What does the vulnerability CVE-2026-3661 entail?
CVE-2026-3661 entails a command injection vulnerability in the adm.cgi file of Wavlink WL-NU516U1, affecting the ota_new_upgrade functionality.