Submeter #755339: Wavlink NU516U1 V240425 Command Injection

# Command Injection Vulnerability in Wavlink NU516U1 (V240425) login.cgi via "ipaddr" Parameter in sub_401A0C

#### Overview

- **Vendor:** Wavlink
- **Product:** NU516U1
- **Version:** WAVLINK-NU516U1-WO-A-2024-04-25-b516aec-GDBYFM
- **Type:** Command Injection
- **Purpose:** USB Printer Server / Wireless Router
- **Firmware Download:** https://docs.wavlink.xyz/Firmware/?category=USB+Printer+Server&model=WL-NU516U1-A
- **Default Login Password:** admin

#### Vulnerability Description

The Wavlink NU516U1 router firmware (version V240425) contains a critical command injection vulnerability within the `/cgi-bin/login.cgi` component. The vulnerability is located in the `sub_401A0C` function, which handles the hidden debugging interface `sys_login1`.

This function is designed to execute a specific system command (`web 2860 sys addUser`), but it directly concatenates the user-supplied `ipaddr` parameter into the string passed to the `system()` call during command construction. Although the developer wrapped the parameter in double quotes, no filtering or escaping is performed on the input content. Attackers can escape the original command structure by closing the double quotes and appending a semicolon (`;`) or by using command substitution characters (`$()`, backticks) to inject and execute arbitrary system commands.

Exploiting this vulnerability requires passing a password verification based on an MD5 hash. However, since this verification relies solely on a static administrator password (default is `admin`) and does not involve dynamic sessions or random tokens, this interface essentially functions as an extremely dangerous backdoor.

• Utilizador: haimianbaobao (UID 94979)
• Submissão: 10/02/2026 15h20 (há 8 meses)
• Moderação: 05/03/2026 19h21 (23 days later)
• Estado: Duplicado
• Entrada VulDB: 325131 [Wavlink WL-NU516U1 240425 /cgi-bin/login.cgi sub_4012A0 ipaddr Elevação de Privilégios]
• Pontos: 0