Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-18588: A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628

62
This week
CRITICAL 9.8REMOTE

CVE-2026-18588 is a critical-severity flaw (CVSS 9.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT_LENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Why this priority

  • Critical severity
  • CISA SSVC: public proof of concept
  • CISA SSVC: automatable with total technical impact
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score9.8 (Critical)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance1.1% (top 35%)
CISA exploited listNo
WeaknessCWE-119, CWE-121
Published2026-08-03
Last modified2026-10-23
Publisher (CNA): VulDB

Timeline

Exact fixes by distribution

Fedora 46 · pspp · FIXED · 2.1.3-2.fc46 · FEDORA-2026-0d6444911b · source
sudo dnf upgrade --advisory=FEDORA-2026-0d6444911b
Fedora ELN · barman · FIXED · 3.20.1-3.eln159 · FEDORA-2026-45ecf042c2 · source
sudo dnf upgrade --advisory=FEDORA-2026-45ecf042c2
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-18588?

No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.

Is CVE-2026-18588 being exploited?

CVE-2026-18588 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-18588 affect?

CVE-2026-18588 affects affected software. Severity is critical (CVSS 9.8). A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT_LENGTH leads to stack-based buffer overflow. Remote exploitation of the attac

How urgent is CVE-2026-18588?

Priority 62/100. Critical severity; CISA SSVC: public proof of concept; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

References

← Back to latest CVEs