CVE-2026-3704: Wavlink NU516U1 Incomplete Fix CVE-2025-10959 firewall.cgi sub_405B2C command injection
A vulnerability has been found in Wavlink NU516U1 251208. This vulnerability affects the function sub405B2C of the file /cgi-bin/firewall.cgi of the component Incomplete Fix CVE-2025-10959. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3704?
CVE-2026-3704 is classified as a high severity vulnerability due to its potential for command injection.
How does CVE-2026-3704 affect the Wavlink NU516U1 device?
CVE-2026-3704 affects the Wavlink NU516U1 by allowing attackers to manipulate the firewall.cgi script, leading to unauthorized command execution.
How do I fix CVE-2026-3704?
To fix CVE-2026-3704, it is recommended to update the Wavlink NU516U1 firmware to the latest version provided by the vendor.
What should I do if I am unable to patch CVE-2026-3704?
If patching for CVE-2026-3704 is not possible, consider implementing additional firewall rules to mitigate the risk of exploitation.
Is CVE-2026-3704 related to any other vulnerabilities?
Yes, CVE-2026-3704 is related to CVE-2025-10959 as it is an incomplete fix for that earlier vulnerability.