SYS::ONLINE
Wasteland.
Briefs1680
Issues22
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-18589 2026-08-03

CVE-2026-18589: Critical Unauthenticated Buffer Overflow in Wavlink WL-NU516U1

"A stack-based buffer overflow in the `nas.cgi` password-change handler of the Wavlink WL-NU516U1 router could allow a remote, unauthenticated attacker to take control of the device, and public exploit code already…"

A stack-based buffer overflow in the nas.cgi password-change handler of the Wavlink WL-NU516U1 router could allow a remote, unauthenticated attacker to take control of the device, and public exploit code already exists.

What Is It

The flaw sits in the change_password function of nas.cgi on Wavlink WL-NU516U1 firmware 708c073-mt7628. Attacker-controlled input passed via the User1Passwd argument is copied without adequate bounds checking, producing a stack-based buffer overflow. VulDB classifies the issue under CWE-121 (stack-based buffer overflow) and CWE-119 (improper restriction of operations within the bounds of a memory buffer).

The attack is executed remotely. Per the CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, no privileges and no user interaction are required, and the impact to confidentiality, integrity, and availability is High across the board. That yields a base score of 9.8 (CRITICAL). The CVSS v4.0 assessment rates it 8.9 (HIGH) with exploit maturity set to Proof-of-Concept.

Why It Matters

This is close to the worst-case shape for an internet-facing embedded device: pre-authentication, network-reachable, low complexity, and full-device impact. The advisory states plainly that "the exploit has been made public and could be used," and a public write-up is hosted on GitHub; so the barrier to weaponization is likely to be very low.

This CVE does not appear in the supplied CISA KEV catalog data, so there is no KEV-confirmed evidence of active exploitation at this time. Treat the public PoC, not KEV status, as the urgency driver.

What's Vulnerable

Patch Status

A fix is available. The advisory notes the vendor was contacted early, responded professionally, and quickly released a fixed version. The required action is to upgrade the affected component; Wavlink publishes a sysupgrade image dated 2026-07-13 (4b8a21f-mt7628) for this model.

Sources