CVE-2025-10961
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on Wavlink NU516U1 routers by manipulating the delete_list parameter in the Delete_Mac_list page. Attackers can exploit this command injection flaw to gain unauthorized access or control of affected devices. Users of Wavlink NU516U1 routers with firmware version M16U1_V240425 are affected.
💻 Affected Systems
- Wavlink NU516U1 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent backdoors, intercept network traffic, pivot to internal networks, or use device as part of botnet.
Likely Case
Unauthorized command execution leading to device configuration changes, network disruption, or credential theft from connected devices.
If Mitigated
Limited impact if device is behind firewall with restricted inbound access and proper network segmentation.
🎯 Exploit Status
Vulnerability details are public but no known exploit code. Exploitation requires crafting specific HTTP requests to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - vendor unresponsive
Vendor Advisory: None - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider replacing device or implementing workarounds.
🔧 Temporary Workarounds
Block access to vulnerable endpoint
linuxUse firewall rules to block access to /cgi-bin/wireless.cgi endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/cgi-bin/wireless.cgi" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string "/cgi-bin/wireless.cgi" --algo bm -j DROP
Disable wireless MAC filtering feature
routerRemove or disable the Delete_Mac_list functionality if possible through admin interface
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict firewall rules
- Implement network monitoring for unusual outbound connections from router
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is M16U1_V240425, device is vulnerable.Check Version:
Login to router admin interface and check firmware version in System Status or About pageVerify Fix Applied:
No official fix available. Verify workarounds by testing if /cgi-bin/wireless.cgi endpoint is inaccessible or returns errors.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/wireless.cgi with shell metacharacters in parameters
- Unexpected command execution in system logs
Network Indicators:
- HTTP requests containing shell commands in delete_list parameter
- Unusual outbound connections from router
SIEM Query:
source="router_logs" AND uri="/cgi-bin/wireless.cgi" AND (param="delete_list" AND value MATCHES "[;&|`$()]+")