CVE-2026-4166: XSS in Wavlink WL-NU516U1 Router

Successful exploitation of CVE-2026-4166 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the Wavlink WL-NU516U1 router's web interface. This can lead to various malicious actions, including session hijacking, credential theft, and redirection to phishing sites. The attacker could potentially gain control over the router's configuration or use it as a launchpad for further attacks on the internal network. Given the router's role as a gateway, a compromised device could expose sensitive data traversing the network.

1. Reserved2026-03-14
2. Published2026-03-15
3. Modified2026-03-17
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-4166 is to upgrade to a patched firmware version from Wavlink when available. Until a patch is released, implement temporary workarounds such as deploying a Web Application Firewall (WAF) to filter malicious requests targeting the /cgi-bin/login.cgi endpoint. Strict input validation on the 'homepage/hostname' parameter is also crucial, rejecting any input containing potentially malicious characters. Regularly review router logs for suspicious activity and consider restricting access to the router's web interface to trusted networks.