CVE-2025-10964
Published: 25 September 2025
Summary
CVE-2025-10964 is a low-severity Injection (CWE-74) vulnerability in Wavlink Wl-Nu516U1 Firmware. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked in the top 24.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-17 (Remote Access).
Deeper analysis
CVE-2025-10964 is a command injection vulnerability (CWE-74, CWE-77) in the Wavlink NU516U1 device, specifically affecting the sub_401B30 function in the /cgi-bin/firewall.cgi file. The flaw is triggered by manipulation of the remoteManagementEnabled argument, enabling attackers to inject arbitrary commands. Published on 2025-09-25, it carries a CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by attackers with low privileges, requiring no user interaction. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, such as executing injected commands within the context of the affected component.
Advisories from VulDB indicate the vendor was contacted early for disclosure but provided no response, with no patches or mitigations detailed. A proof-of-concept exploit is publicly available via GitHub repositories linked in the references. The exploit has been made available to the public and could be exploited.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31156
Vulnerability details
A weakness has been identified in Wavlink NU516U1. Affected by this vulnerability is the function sub_401B30 of the file /cgi-bin/firewall.cgi. This manipulation of the argument remoteManagementEnabled causes command injection. The attack can be initiated remotely. The exploit has been made…
more
available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing /cgi-bin/firewall.cgi enables exploitation of public-facing application (T1190), indirect command execution via web parameter (T1202), and network device CLI abuse on router (T1059.008).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the remoteManagementEnabled argument before it reaches sub_401B30, blocking command injection at the CGI entry point.
Limits the privileges under which firewall.cgi executes, reducing the scope of commands that can be successfully injected and run.
Restricts or requires additional controls on remote access to the device's web management interface, lowering the attack surface for unauthenticated or low-privilege command injection.