Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-3704

A vulnerability has been found in Wavlink NU516U1 251208. This vulnerability affects the function sub_405B2C of the file /cgi-bin/firewall.cgi of the component Incomplete Fix CVE-2025-10959. The manipulation leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:f8e9688a0bc91d3aa992cb466d71d27e874491313dab92d249734b845d10f9e0
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
2

Preserved source conflicts

No provider value was silently selected as the winner.

cvss · 4 assertions

{"metric":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","version":"3.0"},"metric_type":"cvssV3_0"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/metrics/2/cvssV3_0

{"metric":{"baseScore":5.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","version":"4.0"},"metric_type":"cvssV4_0"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/metrics/0/cvssV4_0

{"metric":{"baseScore":5.8,"vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C","version":"2.0"},"metric_type":"cvssV2_0"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/metrics/3/cvssV2_0

{"metric":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","version":"3.1"},"metric_type":"cvssV3_1"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/metrics/1/cvssV3_1
cwe · 2 assertions

{"cweId":"CWE-74","description":"Injection","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-77","description":"Command Injection","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion
{"modules":["Incomplete Fix CVE-2025-10959"],"product":"NU516U1","vendor":"Wavlink","versions":[{"status":"affected","version":"251208"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/affected/0

Provider-owned CVSS observations

4 source assertions
{"metric":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","version":"3.0"},"metric_type":"cvssV3_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/metrics/2/cvssV3_0
{"metric":{"baseScore":5.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P","version":"4.0"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/metrics/0/cvssV4_0
{"metric":{"baseScore":5.8,"vectorString":"AV:N/AC:L/Au:M/C:P/I:P/A:P/E:POC/RL:OF/RC:C","version":"2.0"},"metric_type":"cvssV2_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/metrics/3/cvssV2_0
{"metric":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/metrics/1/cvssV3_1

CWE assertions

2 source assertions
{"cweId":"CWE-74","description":"Injection","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/problemTypes/1/descriptions/0
{"cweId":"CWE-77","description":"Command Injection","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/problemTypes/0/descriptions/0

Source references

6 source assertions
{"tags":["patch"],"url":"https://dl.wavlink.com/firmware/RD/WINSTAR_NU516U1-WO-A-2026-02-27-2fcf6ae-mt7628-squashfs-sysupgrade.bin"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/references/5
{"tags":["related"],"url":"https://github.com/Wlz1112/Wavlink-NU516U1-V251208-/blob/main/wavlink_DMZ.md"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/references/3
{"tags":["exploit"],"url":"https://github.com/Wlz1112/Wavlink-NU516U1-V251208-/blob/main/wavlink_DMZ.md#exp"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/references/4
{"name":"VDB-349650 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"],"url":"https://vuldb.com/?ctiid.349650"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/references/1
{"name":"VDB-349650 | Wavlink NU516U1 Incomplete Fix CVE-2025-10959 firewall.cgi sub_405B2C command injection","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/?id.349650"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/references/0
{"name":"Submit #759233 | Wavlink NU516U1 V251208 Command Injection","tags":["third-party-advisory"],"url":"https://vuldb.com/?submit.759233"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:194552f1d1302685b85eae4bcf99e7e6ccc830a11cdcfc7e751b78e363559f6c · sha256:4b2bfa36f3578c63… · /containers/cna/references/2

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer