A vulnerability was identified in Wavlink WL-NU516U1-A M16U1_V240425

CVE-2026-13539 is a CWE-119 memory-corruption flaw in the Wavlink WL-NU516U1-A wireless repeater running firmware M16U1_V240425. The bug sits in the device's web admin CGI surface — the same adm.cgi/nas.cgi/wireless.cgi family that has produced a dozen similar overflow and command-injection CVEs against this product line throughout 2025–2026. Successful exploitation gives the attacker code execution on the embedded Linux that runs the repeater, typically as root, but only after authenticating to the admin panel (PR:L).

Vendor scored this HIGH (8.8) off the raw CVSS vector. For a fleet defender that label is misleading. Wavlink is a consumer/SOHO brand — these units do not belong in a managed enterprise. If you have any in your 10k-host estate they are rogue/shadow hardware on an access-layer VLAN, not a tier-0 asset. The CVSS vector treats *any* network-reachable RCE as severe, but the *role* this device plays caps the blast radius at the device itself plus whatever broadcast-domain mischief follows from owning one consumer access point.

Why this verdict

• Friction adjustment — authentication required: PR:L means the attacker needs a valid admin session. Default-cred reuse is plausible but not free; a single password change defeats the chain.
• Friction adjustment — exposure population: Wavlink consumer hardware does not appear in managed enterprise CMDBs. Shodan/Censys data caps internet-exposed instances in the low thousands globally.
• Role multiplier — none triggered: The affected component is not on the high-value-role catalog (not a hypervisor, IdP, PAM, CA, backup, EDR, network edge, or DC role). Worst plausible high-value-role outcome is device → same-SSID client MITM, which is host-scope, not fleet-scope. No floor elevation applies.
• No KEV, no in-the-wild signal, EPSS likely <1% — vendor HIGH 8.8 is driven by raw CVSS math; threat reality is a quiet consumer-IoT bug.

Why not higher?

The vendor's HIGH is mathematically defensible from the CVSS vector but ignores deployment reality. To justify MEDIUM or above the bug would need either a high-value-role deployment context (it has none), active exploitation (none observed), or unauthenticated reach (it is PR:L).

Why not lower?

Not IGNORE because shadow-IT Wavlinks do appear in enterprise networks (guest-room repeaters, contractor-brought hardware, lab benches) and a rooted access point is a useful pivot. Asset discovery teams still need to find and remove them; that work is more than zero.

1. Inventory for Wavlink hardware across all VLANs — Run a one-pass discovery against the 001583, 0c9c92, 14a7b4, b0e98b and related Wavlink/Winstars OUIs across every managed switch. For LOW verdicts there is no noisgate mitigation SLA — fold this into the 365-day remediation window, but make it a named ticket so it does not vanish.
2. Block management-plane reach to discovered units — ACL or private-VLAN-isolate the repeater so only a designated admin host can reach TCP/80,443 on it. Removes Step 1 of the attack path entirely.
3. Force credential rotation on any unit you keep — If business owners insist on retaining a Wavlink, rotate off the default admin password. PR:L becomes meaningful friction the moment defaults are gone.
4. Replace with managed AP hardware — The right long-term answer for a 10k-host shop is to not have consumer repeaters at all. Issue a corporate-supported alternative as part of the 365-day remediation cycle (noisgate remediation SLA).

Run from an auditor workstation on the same L2/L3 segment as suspected Wavlink units. Provide the target IP as $1. Requires only standard curl and shell; no privileges on the target. Example: ./check_wavlink.sh 192.168.1.1. Output: VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# noisgate verifier — CVE-2026-13539 Wavlink WL-NU516U1-A buffer overflow
# Usage: ./check_wavlink.sh <target-ip>
# Exit codes: 0 PATCHED/not-affected, 1 VULNERABLE, 2 UNKNOWN
set -u
TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "usage: $0 <target-ip>" >&2
  exit 2
fi

UA='noisgate-verifier/1.0'
VULN_FW='M16U1_V240425'

# 1. Confirm this is actually a Wavlink admin panel
BANNER=$(curl -sk --max-time 5 -A "$UA" "http://${TARGET}/login.shtml" 2>/dev/null)
if ! echo "$BANNER" | grep -qiE 'wavlink|wl-nu516'; then
  echo "UNKNOWN: $TARGET does not present a Wavlink admin panel"
  exit 2
fi

# 2. Pull firmware/model strings from sysinfo endpoints used by this family
SYS=$(curl -sk --max-time 5 -A "$UA" "http://${TARGET}/cgi-bin/ExportSettings.sh" 2>/dev/null)
SYS+=$(curl -sk --max-time 5 -A "$UA" "http://${TARGET}/sysinit.shtml" 2>/dev/null)

MODEL=$(echo "$SYS" | grep -oE 'WL-NU516U1[-A-Z0-9]*' | head -1)
FW=$(echo "$SYS" | grep -oE 'M16U1_V[0-9]+' | head -1)

if [[ -z "$MODEL" && -z "$FW" ]]; then
  echo "UNKNOWN: could not extract model/firmware from $TARGET"
  exit 2
fi

echo "detected model=${MODEL:-?} firmware=${FW:-?}"

# 3. Compare
if [[ "$FW" == "$VULN_FW" ]]; then
  echo "VULNERABLE: $TARGET runs $FW (CVE-2026-13539)"
  exit 1
fi

if [[ "$FW" =~ ^M16U1_V([0-9]+)$ ]]; then
  BUILD="${BASH_REMATCH[1]}"
  if (( BUILD <= 240425 )); then
    echo "VULNERABLE: $TARGET runs $FW (<= 240425, CVE-2026-13539)"
    exit 1
  fi
  echo "PATCHED: $TARGET runs $FW (newer than 240425)"
  exit 0
fi

echo "UNKNOWN: firmware string '$FW' did not match expected pattern"
exit 2

Sources

1. CVE Details — Wavlink WL-NU516U1 firmware M16U1_V240425
2. VulDB — CVE-2026-8189 Wavlink adm.cgi wzdrepeater (sibling)
3. VulDB — CVE-2026-4861 Wavlink nas.cgi ftext stack overflow (sibling)
4. OffSeq Radar — CVE-2026-2565 Wavlink WL-NU516U1 stack overflow (sibling)
5. OffSeq Radar — CVE-2026-2567 Wavlink WL-NU516U1 stack overflow (sibling)
6. CVEFeed — CVE-2025-9149 Wavlink wireless.cgi command injection (related family)
7. Wavlink firmware download portal
8. Firmware mirror — WAVLINK-NU516-V240425