Command Injection Vulnerability in Wavlink NU516U1 Firewall
CVE-2026-3704
Key Information:
Badges
What is CVE-2026-3704?
A security vulnerability exists in the Wavlink NU516U1, specifically targeting the firewall functionality implemented in the /cgi-bin/firewall.cgi file. The flaw arises from an incomplete fix for a prior vulnerability, allowing for remote command injection via the sub_405B2C function. Attackers can exploit this vulnerability to execute arbitrary commands on the affected system, potentially compromising its security. It is essential for users of the NU516U1 to update to the latest version provided by Wavlink to mitigate this risk. The vendor has acknowledged the issue and responded promptly with a patch.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
NU516U1 251208
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved