CVE-2026-18587
Last modified
CVE-2026-18587 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. EPSS estimates a 1.26% chance of exploitation in the next 30 days.
Description
A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been published and may be used. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Wavlink | WL-NU516U1 | 708c073-mt7628 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-18587?
How severe is CVE-2026-18587?
How do I fix CVE-2026-18587?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-1858wget2 accepts a server certificate with incorrect Key Usage …4.8
- CVE-2026-18581A vulnerability was determined in ggml-org llama.cpp e15efe0…3.3
- CVE-2026-18582A security flaw has been discovered in mz-automation libiec6…5.5
- CVE-2026-18583A weakness has been identified in mz-automation libiec61850 …5.5
- CVE-2026-18584A security vulnerability has been detected in GL.iNet E5800,…5.4
- CVE-2026-18585A vulnerability was detected in GL.iNet MT3000, MT6000, BE93…5.3
- CVE-2026-18588A vulnerability has been found in Wavlink WL-NU516U1 708c073…9.8
- CVE-2026-18589A vulnerability was found in Wavlink WL-NU516U1 708c073-mt76…9.8
- CVE-2026-18590A vulnerability was determined in Wavlink WL-NU516U1 708c073…6.3
- CVE-2026-18591A vulnerability was identified in Meesho Online Shopping App…2.1
- CVE-2026-18592A security flaw has been discovered in osCommerce 4.14.63493…4.7
- CVE-2026-18593A weakness has been identified in vxcontrol PentAGI up to 2.…5.6
Are you affected by CVE-2026-18587?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST