Live › vulnerability › CVE-2026-120277
The WAVLINK WN536AX6-A router firmware does not sanitize the group_name argument in its WireGuard CLI group handler, so input passed there is run as an operating system command. An attacker who can reach the device over the network can run commands on it, and a public exploit has been disclosed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 00:22 UTC. All times on this page are UTC.
Owners of the WAVLINK WN536AX6-A router on firmware V260507_2.0.0 are affected, according to VulDB. The flaw is in the WireGuard group handler of the web management backend (/bin/ioos). VulDB says no login is needed, but the vendor has not confirmed that. A public proof of concept exists. Anyone not using this model or this firmware version can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN536AX6-A | vendor | V260507_2.0.0 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120277")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.