CVE-2025-10962
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary commands on Wavlink NU516U1 routers by injecting malicious input into the mac_5g parameter of the SetName page. Attackers can potentially take full control of affected devices. Users of Wavlink NU516U1 routers with firmware version M16U1_V240425 are affected.
💻 Affected Systems
- Wavlink NU516U1 router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to install persistent backdoors, pivot to internal networks, or join botnets.
Likely Case
Router takeover leading to DNS hijacking, credential theft from connected devices, or denial of service.
If Mitigated
Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.
🎯 Exploit Status
Proof of concept is publicly available on GitHub. Attack requires no authentication and can be performed via HTTP request.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: None - vendor did not respond to disclosure
Restart Required: No
Instructions:
No official patch available. Consider workarounds or replacement.
🔧 Temporary Workarounds
Disable remote management
allDisable web management interface from WAN/Internet access
Access router admin panel → Advanced Settings → Remote Management → Disable
Network segmentation
allPlace router on isolated network segment with strict firewall rules
🧯 If You Can't Patch
- Replace affected devices with supported models from responsive vendors
- Implement strict network monitoring and intrusion detection for suspicious HTTP requests to /cgi-bin/wireless.cgi
🔍 How to Verify
Check if Vulnerable:
Check firmware version in router admin interface. If version is M16U1_V240425, device is vulnerable.Check Version:
Login to router web interface and check System Status or Firmware Update pageVerify Fix Applied:
No fix available to verify. Monitor for firmware updates from vendor.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /cgi-bin/wireless.cgi with suspicious mac_5g parameter containing shell metacharacters
Network Indicators:
- Unusual outbound connections from router, unexpected DNS queries, or router initiating connections to unknown IPs
SIEM Query:
source="router_logs" AND uri_path="/cgi-bin/wireless.cgi" AND (param="mac_5g" AND value MATCHES "[;|&`$()]+")