critical · CVSS v3 10 · CVSS v4 10

CVE-2026-120276

WAVLINK WN536AX6-A routers are vulnerable to remote OS command injection via the Web Management Interface. The flaw lies in the handling of

Overview

WAVLINK WN536AX6-A routers are vulnerable to remote OS command injection via the Web Management Interface. The flaw lies in the handling of the group_name parameter in /bin/ioos. Attackers can execute arbitrary commands on the device.

Description

A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

Impact

Confidentiality, Integrity, and Availability are compromised for affected devices. Network administrators and users of the vulnerable router model are at risk of remote code execution, leading to full device takeover.

Remediation

Apply the vendor-supplied firmware update that fixes the command injection in /bin/ioos. If an update is unavailable, disable the Web Management Interface or restrict access to trusted IP ranges, and enforce strong authentication.

Risk context

Critical severity with CVSS 10.0 indicates a high risk. Immediate action is recommended.

Affected products

  • WAVLINK WN536AX6-A

Scores

Severity
critical
CVSS v2
10
CVSS v3
10
CVSS v4
10
EPSS
—

command-injection web-management router remote-execution critical WAVLINK OS-injection

← All CVEs

Related CVEs

critical

CVE-2026-120279

A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

View analysis

critical

CVE-2026-120277

A critical OS command injection flaw exists in the WireGuard CLI Group Handler on WAVLINK WN536AX6-A routers, allowing remote attackers to execute arbitrary commands via the group_name argument. The vulnerability is publicly disclosed and can be exploited without authentication. It poses a severe risk to the confidentiality, integrity, and availability of affected devices.

View analysis

critical

CVE-2026-120280

A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

View analysis

critical

CVE-2026-120281

WAVLINK WN536AX6-A routers are vulnerable to a stack-based buffer overflow in the OpenVPN Handler component. The flaw is triggered by manipulating the openvpn_ip argument in /protocol.csp, allowing remote attackers to potentially execute arbitrary code. The vulnerability is rated critical with a CVSS v3 score of 10.0.

View analysis