CVE-2025-9149

A vulnerability was determined in Wavlink WL-NU516U1 M16U1_V240425. This impacts the function sub_4032E4 of the file /cgi-bin/wireless.cgi. This manipulation of the argument Guest_ssid causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cna@vuldb.com

Published

2025-08-19

Last modified

2025-08-19

Weaknesses

CWE-74, CWE-77

Affected products

• Wl-nu516u1 (Wavlink)
• Wl-nu516u1 Firmware (Wavlink)

References

• https://github.com/lin-3-start/lin-cve/blob/main/Wavlink/Wavlink.md
• https://github.com/lin-3-start/lin-cve/blob/main/Wavlink/Wavlink.md#poc
• https://vuldb.com/?ctiid.320528
• https://vuldb.com/?id.320528
• https://vuldb.com/?submit.629181