CVE-2025-9149 is a Medium severity (CVSS 6.3) command injection in the Wavlink WL-NU516U1 wireless print server, firmware M16U1_V240425. The Guest_ssid argument of the wireless CGI is the entry point. No fixed firmware is confirmed, so restrict access to the admin interface and check the vendor.
What's affected
The record lists Wavlink WL-NU516U1 firmware M16U1_V240425. The function sub_4032E4 in the file /cgi-bin/wireless.cgi mishandles the argument Guest_ssid, which leads to command injection. The record says the attack can be carried out remotely, that the exploit has been disclosed publicly and may be used, and it scores the issue 6.3 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The vector requires low privileges, which usually means a login to the device.
The reporter write-up we read describes a command injection in the device's web management interface that can lead to operating system command execution. It does not name a firmware version and it mentions no patch or vendor response. We could not confirm a fixed version, so the vendor's download page for the model is the place to look for anything newer.
How to check if you're exposed
- Log in to the device's web interface and read the firmware version on the status page. Compare it with M16U1_V240425.
- Find out how the device is attached. Print servers belong on an internal network, and the management page should not be reachable from outside.
- Check any port forwarding rules on your router for this device.
- Inventory devices of this model in offices and remote sites. They are easy to forget because they just work.
What to do now
- Remove any internet exposure of the management interface and port forwards.
- Set a strong unique admin password and confirm default credentials are gone.
- Look on the vendor's download page for firmware newer than M16U1_V240425, and read its notes before flashing.
- Place the device on a segment with only the clients that need to print.
- If nothing is released and the device must stay, treat it as an untrusted peripheral and keep it away from sensitive hosts.
Why it matters
The weakness class is CWE-77 (command injection), part of the wider CWE-74 (injection) family. A web handler builds a system command from a setting, here a guest network name, and the device runs it. Embedded devices often run their web service with high privileges, so a command injection can mean full control of the device.
The record does not list the CVE in CISA's Known Exploited Vulnerabilities catalog, and we found no advisory saying it is exploited. It is the kind of bug that appears again and again in small network hardware, which is why the practical defense is placement and access control rather than waiting on a patch.
Quick check
Is there a fixed firmware for CVE-2025-9149?
Not one we could confirm. The record and the reporter page name none. Check the vendor download page.
Do I need to log in first?
The record vector says low privileges are required, which normally means a valid device login.
Sources
Last reviewed: 18 October 2026.
