CVE-2025-10960
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on Wavlink NU516U1 routers by injecting malicious input into the DeleteMac page's delete_list parameter. Attackers can exploit this without authentication to gain control of affected devices. All users running the vulnerable firmware version are at risk.
💻 Affected Systems
- Wavlink NU516U1
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, pivot to internal networks, or use the device for botnet activities.
Likely Case
Attackers gain shell access to execute commands, potentially stealing credentials, modifying configurations, or disrupting network services.
If Mitigated
With proper network segmentation and access controls, impact is limited to the isolated device without lateral movement.
🎯 Exploit Status
Proof-of-concept exploit code is publicly available on GitHub. Attack requires network access to the management interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: None - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacement.
🔧 Temporary Workarounds
Disable remote management
allDisable web management interface access from WAN/Internet
Navigate to router settings > Remote Management > Disable
Network segmentation
allIsolate router management interface to trusted network segment only
🧯 If You Can't Patch
- Replace affected device with a different model from a responsive vendor
- Implement strict firewall rules to block all external access to the router's management interface
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router web interface. If version is M16U1_V240425, device is vulnerable.Check Version:
Login to router web interface and check System Status or About pageVerify Fix Applied:
No fix available to verify. Monitor for vendor updates.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Multiple failed authentication attempts followed by successful access
- Suspicious entries in web server logs for /cgi-bin/wireless.cgi
Network Indicators:
- Unusual outbound connections from router
- Traffic to known malicious IPs from router
- Unexpected port scans originating from router
SIEM Query:
source="router_logs" AND (uri="/cgi-bin/wireless.cgi" AND (method="POST" OR method="GET") AND (param="delete_list" AND value CONTAINS ";" OR "|" OR "`"))