CVE-2025-9149 Information

Description

A vulnerability was determined in Wavlink WL-NU516U1 M16U1_V240425. This impacts the function sub_4032E4 of the file /cgi-bin/wireless.cgi. This manipulation of the argument Guest_ssid causes command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Reference

https://github.com/lin-3-start/lin-cve/blob/main/Wavlink/Wavlink.md https://github.com/lin-3-start/lin-cve/blob/main/Wavlink/Wavlink.md#poc https://vuldb.com/?ctiid.320528 https://vuldb.com/?id.320528 https://vuldb.com/?submit.629181

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

LOW

Base Severity

6.3

Related CNNVD

CNNVD-202508-2191 (Published: 2025-08-19)