CVE-2026-120282

Overview

A critical OS command injection flaw exists in WAVLINK WN536AX6-A firmware, allowing remote attackers to execute arbitrary commands via the host_black function in /protocol.csp. The vulnerability can be triggered by manipulating the mac argument, enabling full remote code execution. It is publicly disclosed and can be exploited without authentication.

Description

A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

Impact

Confidentiality: attackers can read sensitive configuration and logs. Integrity: they can modify firmware settings or inject malicious commands. Availability: potential to crash the device or disrupt network services. Defenders should consider the risk to all WLAN routers running the affected firmware.

Remediation

Apply the vendor’s firmware patch (v260507 or later) immediately. If a patch is unavailable, disable the host_black endpoint or block external access to the router’s management interface via firewall rules. Additionally, restrict the mac parameter to a whitelist or validate input on the device, and monitor syslog for unexpected command execution.

Risk context

Severity is critical with CVSS 9.9, indicating a high risk of remote exploitation. The lack of EPSS data suggests the vulnerability is newly disclosed, so immediate action is advised.

Affected products

• WAVLINK WN536AX6-A