CVE-2026-2567 Wavlink WL-NU516U1 nas.cgi sub_401218 stack-based overflow
Remote attackers can trigger a stack-based buffer overflow in the Wavlink WL-NU516U1 NAS firmware via the User1Passwd argument, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-2567?
CVE-2026-2567 is a high-severity memory corruption vulnerability in Wavlink WL-NU516U1, published on 16 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was detected in Wavlink WL-NU516U1 20251208. This vulnerability affects the function sub_401218 of the file /cgi-bin/nas.cgi. Performing a manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.
Which versions are affected by CVE-2026-2567?
It affects 1 product.
Products include Wavlink Wl-Nu516u1 Firmware.
How do I fix CVE-2026-2567?
No fix has been published for CVE-2026-2567 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-2567 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-2567 exists.
Other vulnerabilities in Wavlink WL-NU516U1
- CVE-2026-3703 Wavlink NU516U1 login.cgi sub_401A10 out-of-bounds write
- CVE-2026-4861 Wavlink WL-NU516U1 nas.cgi ftext stack-based overflow
- CVE-2026-3612 Wavlink WL-NU516U1 OTA Online Upgrade adm.cgi sub_405AF4 command injection
- CVE-2026-3613 Wavlink WL-NU516U1 login.cgi sub_401A0C stack-based overflow
- CVE-2026-2615 Wavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injection
Sources
Also known as GHSA-844q-r72x-vfmv.