---
id: "CVE-2026-120276"
kind: "vulnerability"
aliases: ["CVE-2026-120276"]
title: "WAVLINK WN536AX6-A router: web interface command injection allows remote code execution"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN536AX6-A", "fixed": [], "affected": "V260507_2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["command-injection", "home-router", "infrastructure", "no-auth-reported", "router", "wavlink", "web-management-interface", "wn536ax6-a"]
not_affected_if: ["admin-interface-not-reachable", "other-firmware-versions"]
published_at: "2026-11-02T00:18:09+00:00"
first_seen_at: "2026-11-02T00:22:57+00:00"
updated_at: "2026-11-02T00:24:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120276", "first_seen_at": "2026-11-02T00:22:57+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T00:24:45+00:00"}]
---

# WAVLINK WN536AX6-A router: web interface command injection allows remote code execution

The WAVLINK WN536AX6-A router firmware (V260507_2.0.0) fails to sanitize the group_name argument in its web management interface, allowing OS command injection. A remote attacker can run commands on the device, and a public exploit has been released.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN536AX6-A affected V260507_2.0.0 fixed ?

## How to check

- Check the firmware version in the router's admin interface; V260507_2.0.0 is the confirmed affected build (other builds not assessed).
- Check whether the web management interface is reachable from the internet or untrusted LAN segments; VulDB says no authentication is needed, so reachability is the exposure.
- Also check any other WAVLINK model you run: sibling /bin/ioos command injections are reported on other models, but this CVE names only WN536AX6-A.

## Timeline

- 2026-11-02T00:22:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120276
- 2026-11-02T00:24:45+00:00 analyst — VulDB (VDB-429620, third-party) says no authentication is required, remote, public PoC on GitHub (not yet seen, link locked); no exploitation in the wild reported. WAVLINK's advisory index (docs.wavlink.xyz) has no entry for this CVE: no vendor advisory or fixed firmware found, so fix stays unknown. Nothing verified (no primary vendor page). Sibling CVEs 120277/120278 hit the same model and /bin/ioos.

## Documents

- [describes] VulDB VDB-429620: WAVLINK WN536AX6-A group_name command injection https://vuldb.com/vuln/429620
- [mentions] WAVLINK Security Advisory index (does not list this CVE) https://docs.wavlink.xyz/Security_Advisory/

## From the sources

A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_