Wavlink - Wl-nu516u1 - CRITICAL - CVE-2026-18589. A stack-based buffer overflow vulnerability has been identified in the Wavlink WL-NU516U1 device, specifically in the change_password function of the nas.cgi file. The issue arises from improper handling of the User1Passwd argument, allowing remote attackers to exploit this vulnerability and potentially execute malicious code. Publicly available exploits have emerged, prompting urgent action for users to upgrade to the latest firmware version to mitigate the risk. The vendor has been responsive to the issue and has released a patch to address the vulnerability.