CVE-2026-3715

This vulnerability allows an attacker to execute cross-site scripting (XSS) attacks remotely by manipulating the Hostname argument in the device's firmware. To exploit this, the attacker needs to send a specially crafted request to the affected device, which can lead to unauthorized actions or data theft from users interacting with the device.

An attacker can remotely execute commands on the Wavlink WL-NU516U1 device by manipulating a specific setting in its firmware. This vulnerability requires no special access, making it a significant risk for anyone using this device.

An attacker can remotely execute arbitrary commands on the Wavlink WL-NU516U1 device due to a flaw in its firmware that allows them to manipulate a specific function. This vulnerability requires no special access, making it relatively easy for an attacker to exploit if they know how.

An attacker can remotely execute malicious commands on the Wavlink WL-NU516U1 device by exploiting a flaw in its firewall settings. This vulnerability can be triggered by manipulating a specific input, and it affects devices with firmware versions up to December 8, 2025.

This vulnerability allows an attacker to remotely crash the Wavlink WL-NU516U1 device or potentially take control of it by exploiting a flaw in how the device handles time zone settings. Although the attack is complex and difficult to execute, public exploit code is available, making it a real threat to unpatched devices.