CVE-2025-10961

CVE Database · CVE-2025-10961

CVE-2025-10961

· MEDIUMAnalyzed

CVSS v3.1

5.5

CVSS v4.0

5.1

EPSS

9.01%

Published

Sep 25, 2025

Modified

Oct 7, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. This affects the function sub_4030C0 of the file /cgi-bin/wireless.cgi of the component Delete_Mac_list Page. Executing manipulation of the argument delete_list can lead to command injection. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-74CWE-77

Affected Products (2)

wavlink · wl-nu516u1_firmwarevulnerable

wavlink · wl-nu516u1

References (4)

https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/Delete_Mac_list.md

ExploitThird Party Advisory

https://vuldb.com/?ctiid.325829

Permissions RequiredVDB Entry

https://vuldb.com/?id.325829

Third Party AdvisoryVDB Entry

https://vuldb.com/?submit.652781

Third Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs