CVE-2026-3662

CVE Database · CVE-2026-3662

CVE-2026-3662

· MEDIUMAnalyzed

CVSS v3.1

4.7

CVSS v4.0

2.0

EPSS

11.17%

Published

Mar 7, 2026

Modified

Apr 28, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A vulnerability has been found in Wavlink WL-NU516U1 240425. This vulnerability affects the function usb_p910 of the file /cgi-bin/adm.cgi. Such manipulation of the argument Pr_mode leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-74CWE-77

Affected Products (2)

wavlink · wl-nu516u1_firmwarevulnerable

wavlink · wl-nu516u1

References (4)

https://github.com/jinhao118/cve/blob/main/WAVLINK_2.md

ExploitThird Party Advisory

https://vuldb.com/?ctiid.349551

Permissions RequiredVDB Entry

https://vuldb.com/?id.349551

Third Party AdvisoryVDB Entry

https://vuldb.com/?submit.758228

Third Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs