CVE-2025-10775

Wavlink WL-NU516U1 firmware (build 240425) contains an OS command injection flaw in the sub_4012A0 function of /cgi-bin/login.cgi, where the ipaddr argument is passed to a command interpreter without proper sanitization. A remote attacker triggers the flaw by submitting a crafted ipaddr value to the login.cgi endpoint, causing arbitrary operating-system commands to run on the device. Successful exploitation yields command execution on the router, though the CVSS 4.0 vector (PR:H, low confidentiality/integrity/availability impact) indicates the attack requires high privileges and has a limited footprint on the affected system. Owners and operators running the disclosed WL-NU516U1 firmware, particularly those whose web administration interface is reachable from the internet, are affected. A public proof-of-concept is available, the issue is not yet in CISA's KEV catalog, EPSS estimates a roughly 20% chance of exploitation within 30 days, and the vendor was notified but has not responded.

What to do: Inventory networks for Wavlink WL-NU516U1 routers and check the running firmware build (240425 was named in the disclosure). Because the vendor has not responded to the disclosure and no patched version is confirmed, do not expose the device's web administration interface (and specifically /cgi-bin/login.cgi) to the internet; restrict access to trusted management networks or via firewall/ACL rules. Review HTTP logs for requests to /cgi-bin/login.cgi containing shell metacharacters in the ipaddr parameter as an indicator of probing or exploitation.