CVE-2026-120280
CriticalCVSS 10.0Summary
A vulnerability has been found in WAVLINK WN536AX6-A version V260507 in the WireGuard component, in the wireguard_cli_group handler of /protocol.csp. Manipulation of the group_id/group_name arguments leads to OS command injection. The exploit has been disclosed publicly and the attack may be initiated remotely.
Risk Assessment
A remote attacker could execute arbitrary OS commands on the device and take full control of it. The public availability of the exploit increases the likelihood of rapid exploitation.
Recommendation
Immediately restrict access to the management interface and apply the vendor patch as soon as it becomes available. Until then, isolate the device within the network.
Other vulnerabilities in WAVLINK WN536AX6-A
See all- CVE-2026-120278Medium
A vulnerability was detected in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_416d48/sub_41a7c0 functions of the /bin/ioos file, within the VPN client list handler component. Manipulation of the opt argument results in missing authentication. The attack can be initiated remotely and the exploit is now public.
- CVE-2026-120282Critical
A vulnerability was determined in WAVLINK WN536AX6-A version V260507 in the host_black function of /protocol.csp. Manipulation of the mac argument causes OS command injection. The exploit has been publicly disclosed and remote exploitation is possible.
- CVE-2026-120281Critical
A vulnerability was found in WAVLINK WN536AX6-A version V260507 in the OpenVPN Handler component, in the strcpy function of /protocol.csp. Manipulation of the openvpn_ip argument results in a stack-based buffer overflow. The exploit has been made public and the attack may be launched remotely.
- CVE-2026-120279Critical
A flaw has been found in WAVLINK WN536AX6-A version V260507 in the openvpn_cli Handler component, in an unknown function of /protocol.csp. Manipulation of the file_id argument can lead to OS command injection. The exploit has been published and the attack can be launched remotely.
- CVE-2026-120277Critical
A vulnerability was detected in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_41a1d8 function of the /bin/ioos file, related to the WireGuard CLI group handler. Manipulation of the group_name argument leads to OS command injection. The issue can be exploited remotely and a public exploit is already available.
- CVE-2026-120276Critical
A weakness was identified in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_416760 function of the /bin/ioos file, within the web management interface component. Manipulation of the group_name argument causes OS command injection. The attack can be initiated remotely and the exploit has been made publicly available.
Original NVD description (English source)
A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS