A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation…

A vulnerability identified as CVE-2026-18587 has been discovered in the Wavlink WL-NU516U1 device running firmware version 708c073-mt7628. The flaw resides in an unknown function within the Config Import component, where manipulation of the Password argument can lead to OS command injection. The attack can be launched remotely, though it is characterized by high complexity and is considered difficult to exploit. The exploit has been publicly disclosed and could be weaponized. The vendor was notified early, responded professionally, and has released a patched firmware version. Users are advised to upgrade to the fixed firmware version to mitigate the risk. The vulnerability has been documented on NVD, VulDB, and a GitHub proof-of-concept report has been published.