CVE-2026-4166 describes a cross-site scripting (XSS) vulnerability affecting the Wavlink WL-NU516U1 router, specifically version 240425. This flaw allows an attacker to inject malicious scripts into the router's web interface, potentially compromising user sessions and data. The vulnerability stems from improper handling of the 'homepage/hostname' argument within the /cgi-bin/login.cgi file. A fix is expected from the vendor.
影响与攻击场景翻译中…
Successful exploitation of CVE-2026-4166 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the Wavlink WL-NU516U1 router's web interface. This can lead to various malicious actions, including session hijacking, credential theft, and redirection to phishing sites. The attacker could potentially gain control over the router's configuration or use it as a launchpad for further attacks on the internal network. Given the router's role as a gateway, a compromised device could expose sensitive data traversing the network.
利用背景翻译中…
CVE-2026-4166 has been publicly disclosed and a proof-of-concept exploit is available, indicating a higher risk of exploitation. The vulnerability is not currently listed on CISA KEV, but its public availability warrants close monitoring. The LOW CVSS score reflects the relatively simple exploitation process and limited potential impact, but the router's network-facing role increases the overall risk.
哪些人处于风险中翻译中…
Small businesses and home users relying on Wavlink WL-NU516U1 routers, particularly those with exposed router management interfaces or weak password policies, are at risk. Shared hosting environments utilizing this router as a gateway could also be impacted.
攻击时间线
- Disclosure
disclosure
威胁情报
漏洞利用状态
EPSS
0.03% (10% 百分位)
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 低 — 任何有效用户账户均可。
- User Interaction
- 需要 — 受害者必须打开文件、点击链接或访问特制页面。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 无 — 无机密性影响。
- Integrity
- 低 — 攻击者可修改部分数据，影响有限。
- Availability
- 无 — 无可用性影响。
受影响的软件
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
- 修改日期
- EPSS 更新日期
缓解措施和替代方案翻译中…
The primary mitigation for CVE-2026-4166 is to upgrade to a patched firmware version from Wavlink when available. Until a patch is released, implement temporary workarounds such as deploying a Web Application Firewall (WAF) to filter malicious requests targeting the /cgi-bin/login.cgi endpoint. Strict input validation on the 'homepage/hostname' parameter is also crucial, rejecting any input containing potentially malicious characters. Regularly review router logs for suspicious activity and consider restricting access to the router's web interface to trusted networks.
修复方法
将 Wavlink WL-NU516U1 路由器固件更新到 240425 之后的版本，以修复 XSS 漏洞。请访问制造商的网站以获取最新的固件版本和更新说明。
CVE 安全通讯
漏洞分析和关键警报直接发送到您的邮箱。
常见问题翻译中…
What is CVE-2026-4166 — XSS in Wavlink WL-NU516U1?
CVE-2026-4166 is a cross-site scripting vulnerability in the Wavlink WL-NU516U1 router version 240425, allowing attackers to inject malicious scripts.
Am I affected by CVE-2026-4166 in Wavlink WL-NU516U1?
If you are using a Wavlink WL-NU516U1 router with firmware version 240425, you are potentially affected by this vulnerability.
How do I fix CVE-2026-4166 in Wavlink WL-NU516U1?
Upgrade to a patched firmware version from Wavlink when available. Until then, use a WAF and strict input validation.
Is CVE-2026-4166 being actively exploited?
A public proof-of-concept exploit is available, suggesting a potential for active exploitation.
Where can I find the official Wavlink advisory for CVE-2026-4166?
Refer to Wavlink's official website or security advisories for updates and information regarding CVE-2026-4166.