Oduoke

**Name of the Vulnerable Software and Affected Versions** Wavlink WL-NU516U1 version 708c073-mt7628 **Description** A flaw in the Config Import component allows for remote OS command injection. This occurs when the `Password` argument is manipulated within an unknown function. OS command injection is a technique where an attacker executes arbitrary operating system commands on the target machine. **Recommendations** Upgrade the affected component to the fixed version released by the vendor.

**Name of the Vulnerable Software and Affected Versions** Wavlink WL-NU516U1 version 708c073-mt7628 **Description** A stack-based buffer overflow occurs in the `fgets()` function within the `nas.cgi` file. This issue is triggered by the manipulation of the `CONTENT LENGTH` argument, allowing for remote exploitation. **Recommendations** Upgrade the affected component to the fixed version released by the vendor.

**Name of the Vulnerable Software and Affected Versions** Wavlink WL-NU516U1 version 708c073-mt7628 **Description** A remote attack is possible due to a stack-based buffer overflow, which occurs when the `User1Passwd` argument is manipulated within the `change password()` function of the `nas.cgi` file. A stack-based buffer overflow is a condition where a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially leading to crashes or arbitrary code execution. **Recommendations** Upgrade the affected component to the fixed version released by the vendor. As a temporary mitigation, restrict access to the `nas.cgi` file or avoid using the `User1Passwd` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Wavlink WL-NU516U1 708c073-mt7628 **Description** The Admin Password Handler component contains an OS command injection flaw that can be exploited remotely. The issue resides in the `set sys adm()` function within the `adm.cgi` file, allowing an attacker to execute arbitrary operating system commands. **Recommendations** Upgrade the affected component to the fixed version released by the vendor.