CVE-2026-3704
📋 TL;DR
This CVE describes a command injection vulnerability in Wavlink NU516U1 routers affecting the firewall.cgi component. Attackers can remotely execute arbitrary commands on vulnerable devices. This affects users running the vulnerable firmware version of these specific Wavlink router models.
💻 Affected Systems
- Wavlink NU516U1
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent backdoors, pivot to internal networks, or use device in botnets.
Likely Case
Remote code execution leading to device takeover, credential theft, or network reconnaissance.
If Mitigated
Limited impact if device is behind firewall with restricted WAN access and proper network segmentation.
🎯 Exploit Status
Exploit code is publicly available on GitHub. The vulnerability allows remote command injection without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: WINSTAR_NU516U1-WO-A-2026-02-27-2fcf6ae-mt7628-squashfs-sysupgrade.bin
Vendor Advisory: https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-02-27-2fcf6ae-mt7628-squashfs-sysupgrade.bin
Restart Required: Yes
Instructions:
1. Download the patched firmware from Wavlink's official site. 2. Access router admin interface. 3. Navigate to firmware upgrade section. 4. Upload the new firmware file. 5. Wait for upgrade to complete and router to reboot.
🔧 Temporary Workarounds
Disable WAN access to admin interface
linuxPrevent remote exploitation by blocking external access to router management interface
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP
iptables -A INPUT -p tcp --dport 443 -s ! 192.168.1.0/24 -j DROP
Disable DMZ functionality
allRemove attack surface by disabling the vulnerable DMZ configuration component
🧯 If You Can't Patch
- Isolate affected routers in separate VLAN with strict firewall rules
- Implement network monitoring for suspicious traffic to/from router management interface
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 251208, device is vulnerable.Check Version:
Check router web interface or use: curl -s http://router-ip/ | grep -i firmwareVerify Fix Applied:
After patching, verify firmware version shows WINSTAR_NU516U1-WO-A-2026-02-27-2fcf6ae-mt7628 or later.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /cgi-bin/firewall.cgi
- Suspicious command execution in system logs
- Multiple failed authentication attempts to router interface
Network Indicators:
- Unusual outbound connections from router
- Traffic to known malicious IPs from router
- Port scanning originating from router
SIEM Query:
source="router-logs" AND (uri="/cgi-bin/firewall.cgi" OR cmd="*sh*" OR cmd="*bash*")🔗 References
- https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-02-27-2fcf6ae-mt7628-squashfs-sysupgrade.bin
- https://github.com/Wlz1112/Wavlink-NU516U1-V251208-/blob/main/wavlink_DMZ.md
- https://github.com/Wlz1112/Wavlink-NU516U1-V251208-/blob/main/wavlink_DMZ.md#exp
- https://vuldb.com/?ctiid.349650
- https://vuldb.com/?id.349650
- https://vuldb.com/?submit.759233
