CVE-2026-2615

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A flaw has been found in Wavlink WL-NU516U1 up to 20251208. The affected element is the function singlePortForwardDelete of the file /cgi-bin/firewall.cgi. Executing a manipulation of the argument del_flag can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Feb 17, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-2615010.0Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.CVE-2026-261517.1Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over a network CVE-2026-261527.0Insecure storage of sensitive information in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.CVE-2026-261537.8Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.CVE-2026-261547.5Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.CVE-2026-261556.5Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability CVE-2026-261567.8Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally.CVE-2026-261577.0A flaw was found in BusyBox. Incomplete path sanitization in its archive extraction utilities allows an attacker to craft malicious archives CVE-2026-261587.0A flaw was found in BusyBox. This vulnerability allows an attacker to modify files outside of the intended extraction directory by crafting CVE-2026-261597.8Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges CVE-2026-26169.8A vulnerability has been found in Beetel 777VR1 up to 01.00.09. The impacted element is an unknown function of the component Web Management CVE-2026-261607.8Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges