{"id":"CVE-2026-120276","kind":"vulnerability","aliases":["CVE-2026-120276"],"related":[],"title":"WAVLINK WN536AX6-A router: web interface command injection allows remote code execution","description":"A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.","summary":"The WAVLINK WN536AX6-A router firmware (V260507_2.0.0) fails to sanitize the group_name argument in its web management interface, allowing OS command injection. A remote attacker can run commands on the device, and a public exploit has been released.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN536AX6-A","fixed":[],"affected":"V260507_2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["command-injection","home-router","infrastructure","no-auth-reported","router","wavlink","web-management-interface","wn536ax6-a"],"not_affected_if":["admin-interface-not-reachable","other-firmware-versions"],"how_to_check":"- Check the firmware version in the router's admin interface; V260507_2.0.0 is the confirmed affected build (other builds not assessed).\n- Check whether the web management interface is reachable from the internet or untrusted LAN segments; VulDB says no authentication is needed, so reachability is the exposure.\n- Also check any other WAVLINK model you run: sibling /bin/ioos command injections are reported on other models, but this CVE names only WN536AX6-A.","fix":null,"status":"open","published_at":"2026-11-02T00:18:09+00:00","first_seen_at":"2026-11-02T00:22:57+00:00","triaged_at":"2026-11-02T00:23:50+00:00","updated_at":"2026-11-02T00:24:45+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-02T00:23:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN536AX6-A router: web interface command injection allows remote code execution","impact":"high","summary":"The WAVLINK WN536AX6-A router firmware (V260507_2.0.0) fails to sanitize the group_name argument in its web management interface, allowing OS command injection. A remote attacker can run commands on the device, and a public exploit has been released.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn536ax6-a","router","web-management-interface","home-router"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary operating system commands on the router remotely.","analyst_note":"Find the vendor advisory or a firmware fix and confirm whether authentication is needed to reach the group_name parameter (NVD entry linked in sources).","how_to_check":"- Check the firmware version in the router's admin interface and compare it to `V260507_2.0.0`\n- Confirm whether the web management interface is reachable from the internet\n- unknown for any further vendor-specific check, as the sources do not say","plain_action":"If you own a WAVLINK WN536AX6-A router, check its firmware version and restrict access to its admin page until the vendor releases a fix.","needs_analyst":true,"not_affected_if":["other-firmware-versions","admin-interface-not-reachable"],"who_is_affected":"Devices running WAVLINK WN536AX6-A firmware V260507_2.0.0 with the Web Management Interface reachable over the network. Exposure is highest where the admin interface is accessible from the internet. Owners of other models or firmware versions are not described as affected by the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000737,"input_tokens":4160,"output_tokens":642,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory or a firmware fix and confirm whether authentication is needed to reach the group_name parameter (NVD entry linked in sources).","search":"'-120276':16A,19A '-2026':15A,18A '/bin/ioos':105C '2.0.0':50B,94C '416760':101C 'a':22A 'affect':97C 'allow':10A,63B 'argument':57B,116C 'attack':69B,129C,145C 'auth':32B 'avail':136C 'caus':119C 'code':12A 'command':8A,24B,65B,72B,121C 'command-inject':23B 'compon':108C 'contact':149C 'could':141C 'cve':14A,17A 'devic':75B 'disclosur':153C 'earli':150C 'execut':13A 'exploit':79B,132C 'fail':51B 'file':104C 'firmwar':48B 'function':99C 'group':55B,117C 'home':27B 'home-rout':26B 'identifi':87C 'infrastructur':29B 'initi':127C 'inject':9A,25B,66B,122C 'interfac':7A,39B,62B,111C 'made':135C 'manag':38B,61B,110C 'manipul':113C 'name':56B,118C 'no-auth-report':30B 'os':64B,120C 'possibl':125C 'public':78B,139C 'releas':82B 'remot':11A,68B,130C 'report':33B 'router':5A,28B,34B,47B 'run':71B 'sanit':53B 'sub':100C 'use':143C 'v260507':49B,93C 'vendor':147C 'vulner':96C 'wavlink':1A,35B,43B,89C 'weak':84C 'web':6A,37B,60B,109C 'web-management-interfac':36B 'wn536ax6':3A,21A,41B,45B,91C 'wn536ax6-a':2A,20A,40B,44B,90C","nicknames":[],"mitigations":[],"who_affected":"WAVLINK WN536AX6-A routers running firmware V260507_2.0.0 whose web management interface can be reached by an attacker. VulDB states no authentication is required, but this comes from a third-party database, not WAVLINK. Other models or firmware versions are not named for this CVE.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a WAVLINK WN536AX6-A router, don't expose its admin page to the internet and check WAVLINK's support site for a firmware update.","first_public_at":"2026-11-02T00:18:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120276","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120276","severity":null,"published_at":"2026-11-02T00:18:09+00:00","modified_at":"2026-11-02T00:18:09+00:00","first_seen_at":"2026-11-02T00:22:57+00:00","fetched_at":"2026-11-02T00:22:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120276:1330","url":null,"severity":null,"published_at":"2026-11-02T00:24:45+00:00","modified_at":"2026-11-02T00:24:45+00:00","first_seen_at":"2026-11-02T00:24:45+00:00","fetched_at":"2026-11-02T00:24:45+00:00","note":"VulDB (VDB-429620, third-party) says no authentication is required, remote, public PoC on GitHub (not yet seen, link locked); no exploitation in the wild reported. WAVLINK's advisory index (docs.wavlink.xyz) has no entry for this CVE: no vendor advisory or fixed firmware found, so fix stays unknown. Nothing verified (no primary vendor page). Sibling CVEs 120277/120278 hit the same model and /bin/ioos."}],"documents":[{"id":41469,"url":"https://vuldb.com/vuln/429620","title":"VulDB VDB-429620: WAVLINK WN536AX6-A group_name command injection","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":39242,"url":"https://docs.wavlink.xyz/Security_Advisory/","title":"WAVLINK Security Advisory index (does not list this CVE)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}