CVE-2026-2615

high · 7.3

A flaw has been found in Wavlink WL-NU516U1 up to 20251208. The affected element is the function singlePortForwardDelete of the file /cgi-bin/firewall.cgi. Executing a manipulation of the argument del_flag can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

7.3

CVSS

12.0%

EPSS (exploit prob.)

96th

EPSS percentile

2026-02-17

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-74CWE-77

Affected products

Vendor	Product	Affected versions
wavlink	wl-nu516u1_firmware	<= 2025-12-08
wavlink	wl-nu516u1	all versions

Check a specific version with /api/v1/cve/match.

References

https://github.com/Wlz1112/Wavlink-NU516U1-V251208-/blob/main/singlePortForwardDelete.md
https://github.com/Wlz1112/Wavlink-NU516U1-V251208-/blob/main/singlePortForwardDelete.md#exp
https://vuldb.com/?ctiid.346265
https://vuldb.com/?id.346265
https://vuldb.com/?submit.751047

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-2615