CVE-2025-10958
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on Wavlink NU516U1 routers by injecting malicious commands through the macAddr parameter in the AddMac page. The flaw exists in the wireless.cgi component and affects devices running firmware version M16U1_V240425. Attackers can exploit this without authentication to gain control of vulnerable devices.
💻 Affected Systems
- Wavlink NU516U1
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent backdoors, intercept network traffic, pivot to internal networks, or use device as part of botnet.
Likely Case
Remote code execution leading to device takeover, credential theft, network reconnaissance, and potential lateral movement within the network.
If Mitigated
Limited impact if device is behind firewall with strict inbound filtering and network segmentation prevents lateral movement.
🎯 Exploit Status
Proof of concept exploit is publicly available on GitHub. Remote exploitation is possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: NONE
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Consider replacing affected devices or implementing workarounds.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected devices in separate VLAN with strict firewall rules preventing external access to management interface.
Access Control
allImplement strict source IP restrictions to limit access to management interface only from trusted administrative networks.
🧯 If You Can't Patch
- Disable remote management interface if not required
- Implement network monitoring for suspicious traffic to/from affected devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or SSH. If version is M16U1_V240425, device is vulnerable.Check Version:
Check web interface System Status page or use: cat /proc/versionVerify Fix Applied:
No official fix available. Verify workarounds by testing if management interface is inaccessible from untrusted networks.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple failed authentication attempts followed by successful access
- Suspicious processes spawned from web interface
Network Indicators:
- Unusual outbound connections from router
- Traffic to known malicious IPs
- Unexpected port scans originating from router
SIEM Query:
source="router_logs" AND ("command injection" OR "macAddr" AND suspicious_pattern)🔗 References
- https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/AddMac.md
- https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/AddMac.md#poc
- https://vuldb.com/?ctiid.325826
- https://vuldb.com/?id.325826
- https://vuldb.com/?submit.652768
- https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/AddMac.md
- https://github.com/panda666-888/vuls/blob/main/wavlink/nu516u1/AddMac.md#poc
