CVE-2025-10964
Published: 25 September 2025
Summary
CVE-2025-10964 is a medium-severity Injection (CWE-74) vulnerability in Wavlink Wl-Nu516U1 Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked at the 44.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in public-facing /cgi-bin/firewall.cgi enables exploitation of public-facing application (T1190), indirect command execution via web parameter (T1202), and network device CLI abuse on router (T1059.008).
NVD Description
A weakness has been identified in Wavlink NU516U1. Affected by this vulnerability is the function sub_401B30 of the file /cgi-bin/firewall.cgi. This manipulation of the argument remoteManagementEnabled causes command injection. The attack can be initiated remotely. The exploit has been made…
more
available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Deeper analysisAI
CVE-2025-10964 is a command injection vulnerability (CWE-74, CWE-77) in the Wavlink NU516U1 device, specifically affecting the sub_401B30 function in the /cgi-bin/firewall.cgi file. The flaw is triggered by manipulation of the remoteManagementEnabled argument, enabling attackers to inject arbitrary commands. Published on 2025-09-25, it carries a CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
The vulnerability can be exploited remotely by attackers with low privileges, requiring no user interaction. Successful exploitation allows limited impacts on confidentiality, integrity, and availability, such as executing injected commands within the context of the affected component.
Advisories from VulDB indicate the vendor was contacted early for disclosure but provided no response, with no patches or mitigations detailed. A proof-of-concept exploit is publicly available via GitHub repositories linked in the references. The exploit has been made available to the public and could be exploited.
Details
- CWE(s)