Back to overview

CVE-2026-15513

MEDIUM
6.3
CVSS 3.1
Description
A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lan_ip results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Metadata

CVE ID
CVE-2026-15513
State
PUBLISHED
Assigner
VulDB
Reserved
2026-07-12 06:26 UTC
Published
2026-07-12 23:30 UTC
Last updated
2026-07-12 23:30 UTC
Primary CWE
CWE-78
OS Command Injection
Vendor / Product
Wavlink / WL-NU516U1
Sources
cve.org  ·  NVD

Severity & Metrics

6.3 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
Affected products (1)
VendorProductPlatformVersions
Wavlink WL-NU516U1 — 260515
Weakness (CWE)
CWESourceDescription
CWE-77 cna Command Injection
CWE-78 cna OS Command Injection
CVSS scores (4)
ScoreSeverityVersionSourceVector
6.5 N/D 2.0 cna AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C
6.3 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
6.3 MEDIUM 3.0 cna CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
5.3 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
References (6)
Back to overview