## Summary
Wavlink WL-NU516U1 (firmware V240425 / m16u1_v240425) contains a stack-based buffer overflow in /cgi-bin/login.cgi, specifically in sub_401A0C, triggered via the ipaddr argument. The issue is remotely reachable and the referenced advisory notes that the exploit is publicly available and could be used.
## Technical Details
- Vulnerable component: /cgi-bin/login.cgi
- Vulnerable function: sub_401A0C
- Trigger: ipaddr parameter (mapped to v4 in the referenced analysis)
- Root cause: use of sprintf(v15, "web 2860 sys addUser \"%s\"", v4); where v15 is a fixed stack buffer (128 bytes) and sprintf is used without bounds checking.
- Preconditions: the submitted password parameter must match the MD5 hash of the administrator password.
- Overflow behavior: sending an overly long ipaddr (exceeding ~105 bytes per the reference) overwrites adjacent stack data including saved registers and the return address.
- Observed outcome: CGI process crash (Segmentation Fault) leading to DoS; under specific conditions, the reference indicates potential RCE.
## Affected
- wavlink wl-nu516u1 firmware m16u1_v240425 (Wavlink NU516U1 V240425 / WAVLINK-NU516U1-WO-A-2024-04-25-b516aec-GDBYFM)
## Impact
- Remote DoS via stack corruption in sub_401A0C.
- Potential Remote Code Execution (RCE) is described as possible “under specific conditions,” with the exploit publicly available.
## Mitigation
1. Patch immediately to a vendor-fixed firmware version (the reference points to Wavlink’s firmware download portal for WL-NU516U1-A).
2. Restrict access to the device’s web interface (network-level controls), since the attack is remotely reachable.
3. Reduce exposure of administrative credentials: the reference notes the password MD5-hash check is required, so ensure strong admin password hygiene and avoid default credentials (the advisory lists default login password as admin).
4. Monitor for crashes/abnormal login attempts targeting the sys_login1 handler and malformed/overlong ipaddr values.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-119