CVE-2026-4861: fallo de gravedad alta en Wavlink WL-NU516U1
Wavlink WL-NU516U1 nas.cgi ftext stack-based overflow
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 0.9%
A weakness has been identified in Wavlink WL-NU516U1 260227. This vulnerability affects the function ftext of the file /cgi-bin/nas.cgi. This manipulation of the argument Content-Length causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Productos afectados
Wavlink · WL-NU516U1CVEs relacionadas — Wavlink WL-NU516U1
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-3662MEDIUMWavlink WL-NU516U1 adm.cgi usb_p910 command injectionEPSS 20.3%CVE-2026-3661MEDIUMWavlink WL-NU516U1 adm.cgi ota_new_upgrade command injectionEPSS 19.7%CVE-2025-10775MEDIUMWavlink WL-NU516U1 login.cgi sub_4012A0 os command injectionEPSS 16.7%CVE-2026-3612HIGHWavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub_405AF4 command injectionEPSS 14.3%CVE-2026-2615HIGHWavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injectionEPSS 13.4%CVE-2025-9149MEDIUMWavlink WL-NU516U1 wireless.cgi sub_4032E4 command injectionEPSS 5.2%