CVE-2026-4166: Wavlink WL-NU516U1 login.cgi sub_404F68 cross site scripting
A vulnerability was found in Wavlink WL-NU516U1 240425. The impacted element is the function sub404F68 of the file /cgi-bin/login.cgi. The manipulation of the argument homepage/hostname results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4166?
CVE-2026-4166 is classified as a cross-site scripting vulnerability affecting Wavlink WL-NU516U1.
How do I fix CVE-2026-4166?
To fix CVE-2026-4166, ensure proper input validation and encoding in the affected login.cgi file.
What causes CVE-2026-4166?
CVE-2026-4166 is caused by improper handling of the 'homepage' or 'hostname' input parameters in the login.cgi script.
Who is affected by CVE-2026-4166?
CVE-2026-4166 affects users of the Wavlink WL-NU516U1 device that utilizes the vulnerable CGI script.
What are the potential impacts of CVE-2026-4166?
The potential impacts of CVE-2026-4166 include exploitation that could lead to unauthorized actions on behalf of users through cross-site scripting.