A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTE…

A stack-based buffer overflow vulnerability has been discovered in the Wavlink WL-NU516U1 router running firmware version 708c073-mt7628. The vulnerability exists in the fgets function within the nas.cgi file, where manipulation of the CONTENT_LENGTH argument can trigger the overflow. The flaw is remotely exploitable, making it a significant security risk for affected devices. The vulnerability was responsibly disclosed to the vendor, who responded professionally and promptly released a patched firmware version. Users are advised to upgrade to the fixed firmware version (WINSTAR_NU516U1-WO-A-2026-07-13-4b8a21f-mt7628) to mitigate the risk. The issue is tracked as CVE-2026-18588 and has been documented across multiple security databases including NVD and VulDB.