Wavlink WL-NU516U1 login.cgi sub_404F68 クロスサイトスクリプティング

Successful exploitation of CVE-2026-4166 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the Wavlink WL-NU516U1 router's web interface. This can lead to various malicious actions, including session hijacking, credential theft, and redirection to phishing sites. The attacker could potentially gain control over the router's configuration or use it as a launchpad for further attacks on the internal network. Given the router's role as a gateway, a compromised device could expose sensitive data traversing the network.

Small businesses and home users relying on Wavlink WL-NU516U1 routers, particularly those with exposed router management interfaces or weak password policies, are at risk. Shared hosting environments utilizing this router as a gateway could also be impacted.

1. 2026-03-15Disclosure

   disclosure

1. 予約済み2026-03-14
2. 公開日2026-03-15
3. 更新日2026-03-17
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2026-4166 is to upgrade to a patched firmware version from Wavlink when available. Until a patch is released, implement temporary workarounds such as deploying a Web Application Firewall (WAF) to filter malicious requests targeting the /cgi-bin/login.cgi endpoint. Strict input validation on the 'homepage/hostname' parameter is also crucial, rejecting any input containing potentially malicious characters. Regularly review router logs for suspicious activity and consider restricting access to the router's web interface to trusted networks.