Live › vulnerability › CVE-2026-120276
The WAVLINK WN536AX6-A router firmware (V260507_2.0.0) fails to sanitize the group_name argument in its web management interface, allowing OS command injection. A remote attacker can run commands on the device, and a public exploit has been released.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 00:22 UTC. All times on this page are UTC.
WAVLINK WN536AX6-A routers running firmware V260507_2.0.0 whose web management interface can be reached by an attacker. VulDB states no authentication is required, but this comes from a third-party database, not WAVLINK. Other models or firmware versions are not named for this CVE.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN536AX6-A | vendor | V260507_2.0.0 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120276")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.