CVE-2026-8229 — Wavlink NU516U1 Command Injection

title: CVE-2026-8229 Wavlink NU516U1 Command Injection via wireless.cgi
id: scw-2026-05-10-ai-1
status: experimental
level: critical
description: |
  Detects attempts to exploit CVE-2026-8229 by targeting the wireless.cgi script on Wavlink NU516U1 devices. The exploit involves manipulating the AuthMethod and EncrypType parameters to inject OS commands, indicated by the presence of common command injection characters within the URI query string.
author: SCW Feed Engine (AI-generated)
date: 2026-05-10
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8229/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/cgi-bin/wireless.cgi'
      cs-uri-query|contains:
          - 'AuthMethod='
          - 'EncrypType='
      cs-uri-query|contains:
          - ';'
          - '|'
          - '`'
          - '$()'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse