CVE-2026-18589

Name of the Vulnerable Software and Affected Versions Wavlink WL-NU516U1 version 708c073-mt7628

Description A remote attack is possible due to a stack-based buffer overflow, which occurs when the User1Passwd argument is manipulated within the change password() function of the nas.cgi file. A stack-based buffer overflow is a condition where a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially leading to crashes or arbitrary code execution.

Recommendations Upgrade the affected component to the fixed version released by the vendor. As a temporary mitigation, restrict access to the nas.cgi file or avoid using the User1Passwd parameter until the update is applied.