| Title | Wavlink NU516U1 V240425 Command Injection |
|---|
| Description | # Remote Command Execution Vulnerability in Wavlink NU516U1 (V240425) via "firmware_url" Parameter in "ota_new_upgrade" Function in "adm.cgi" Component
#### Overview
- **Vendor:** Wavlink
- **Product:** NU516U1
- **Version:** WAVLINK-NU516U1-WO-A-2024-04-25-b516aec-GDBYFM (V240425)
- **Product Type:** USB Printer Server
- **Vulnerability Type:** Command Injection
- **Firmware Download:** `https://docs.wavlink.xyz/Firmware/?category=USB+Printer+Server&model=WL-NU516U1-A`
- **Default Password:** admin
#### Vulnerability Description
A severe command injection vulnerability exists in the `/cgi-bin/adm.cgi` component of the Wavlink NU516U1 router firmware (Version V240425). The vulnerability is located in the `sub_405AF4` function, which handles the OTA online upgrade (`ota_new_upgrade`) functionality. When processing the `firmware_url` parameter, the vendor directly concatenates it into a system command. Although the developer attempted to wrap the parameter in double quotes to prevent argument escape, this defense mechanism cannot prevent Shell Command Substitution. An authenticated remote attacker can execute arbitrary system commands by crafting a malicious `firmware_url` parameter containing `$()` or backticks, bypassing restrictions and gaining full Root control of the device. |
|---|
| Source | ⚠️ https://github.com/Wlz1112/WAVLINK-NU516-V240425/blob/main/firmware_url.md |
|---|
| User | haimianbaobao (UID 94979) |
|---|
| Submission | 02/09/2026 15:09 (6 months ago) |
|---|
| Moderation | 03/05/2026 19:20 (24 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 349220 [Wavlink WL-NU516U1 V240425 OTA Online Upgrade /cgi-bin/adm.cgi sub_405AF4 firmware_url command injection] |
|---|
| Points | 20 |
|---|