A stack-based buffer overflow vulnerability (CVE-2026-18589) was discovered in the Wavlink WL-NU516U1 device running firmware version 708c073-mt7628. The vulnerability exists in the change_password function within the nas.cgi file, where manipulation of the User1Passwd argument triggers the overflow. The flaw can be exploited remotely, and a public exploit has been released, increasing the risk of active exploitation. The vendor was responsibly disclosed and responded professionally, quickly releasing a patched firmware version. Users are strongly advised to upgrade to the fixed firmware available from the vendor. The vulnerability affects NAS-related functionality on the device, potentially exposing sensitive data and system control to remote attackers. Given the public exploit availability and remote exploitability, this is considered a high-severity issue.