Wavlink Wl-NU516U1 vulnerabilities

7 CVEs affecting Wavlink Wl-NU516U1, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-18590, published 2026-08-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-18587, published 2026-08-03. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to…
CVE-2026-18590, published 2026-08-03. Medium severity, CVSS 6.3. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function set_sys_adm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os…
CVE-2026-15513, published 2026-07-13. Medium severity, CVSS 6.3. EPSS: 1.8% chance of exploitation in the next 30 days. A security flaw has been discovered in Wavlink WL-NU516U1 260515. This affects the function wlink_uci_set_value of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument lan_ip results…
CVE-2026-18589, published 2026-08-03. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function change_password of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based…
CVE-2026-18588, published 2026-08-03. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT_LENGTH leads to stack-based buffer…
CVE-2026-2566, published 2026-02-16. High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days. A security vulnerability has been detected in Wavlink WL-NU516U1 up to 130/260. This affects the function sub_406194 of the file /cgi-bin/adm.cgi. Such manipulation of the argument firmware_url leads…
CVE-2026-4166, published 2026-03-16. Low severity, CVSS 3.5. EPSS: 0.4% chance of exploitation in the next 30 days. A vulnerability was found in Wavlink WL-NU516U1 240425. The impacted element is the function sub_404F68 of the file /cgi-bin/login.cgi. The manipulation of the argument homepage/hostname results in…