CVE-2026-120279
CriticalCVSS 10.0Summary
A flaw has been found in WAVLINK WN536AX6-A version V260507 in the openvpn_cli Handler component, in an unknown function of /protocol.csp. Manipulation of the file_id argument can lead to OS command injection. The exploit has been published and the attack can be launched remotely.
Risk Assessment
A remote attacker could execute arbitrary OS commands on the device and take full control of it. The public availability of the exploit increases the risk of exploitation in attacks.
Recommendation
Immediately restrict access to the management interface and update the firmware once the vendor releases a patch. Until then, consider disabling the OpenVPN CLI feature on the device.
Other vulnerabilities in WAVLINK WN536AX6-A
See all- CVE-2026-120278Medium
A vulnerability was detected in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_416d48/sub_41a7c0 functions of the /bin/ioos file, within the VPN client list handler component. Manipulation of the opt argument results in missing authentication. The attack can be initiated remotely and the exploit is now public.
- CVE-2026-120282Critical
A vulnerability was determined in WAVLINK WN536AX6-A version V260507 in the host_black function of /protocol.csp. Manipulation of the mac argument causes OS command injection. The exploit has been publicly disclosed and remote exploitation is possible.
- CVE-2026-120281Critical
A vulnerability was found in WAVLINK WN536AX6-A version V260507 in the OpenVPN Handler component, in the strcpy function of /protocol.csp. Manipulation of the openvpn_ip argument results in a stack-based buffer overflow. The exploit has been made public and the attack may be launched remotely.
- CVE-2026-120280Critical
A vulnerability has been found in WAVLINK WN536AX6-A version V260507 in the WireGuard component, in the wireguard_cli_group handler of /protocol.csp. Manipulation of the group_id/group_name arguments leads to OS command injection. The exploit has been disclosed publicly and the attack may be initiated remotely.
- CVE-2026-120277Critical
A vulnerability was detected in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_41a1d8 function of the /bin/ioos file, related to the WireGuard CLI group handler. Manipulation of the group_name argument leads to OS command injection. The issue can be exploited remotely and a public exploit is already available.
- CVE-2026-120276Critical
A weakness was identified in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_416760 function of the /bin/ioos file, within the web management interface component. Manipulation of the group_name argument causes OS command injection. The attack can be initiated remotely and the exploit has been made publicly available.
Original NVD description (English source)
A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS