{"id":"CVE-2026-120277","kind":"vulnerability","aliases":["CVE-2026-120277"],"related":[],"title":"WAVLINK WN536AX6-A router: command injection via WireGuard group name, no fix listed","description":"A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.","summary":"The WAVLINK WN536AX6-A router firmware does not sanitize the group_name argument in its WireGuard CLI group handler, so input passed there is run as an operating system command. An attacker who can reach the device over the network can run commands on it, and a public exploit has been disclosed.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN536AX6-A","fixed":[],"affected":"V260507_2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","iot","router","wavlink","wireguard","wn536ax6-a"],"not_affected_if":["no-wireguard-exposure","other-firmware-version","other-model"],"how_to_check":"- Check the firmware version in the router admin page; V260507_2.0.0 is the only version listed as affected.\n- Check whether the web management interface is reachable from the internet or untrusted networks; turn off remote management and the WireGuard server if you do not use them.\n- Also check other WAVLINK models: a similar WireGuard group handler flaw was reported on a sibling model (not confirmed affected here).","fix":null,"status":"open","published_at":"2026-11-02T00:18:10+00:00","first_seen_at":"2026-11-02T00:22:57+00:00","triaged_at":"2026-11-02T00:23:50+00:00","updated_at":"2026-11-02T00:24:43+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-02T00:23:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN536AX6-A router: remote command injection via WireGuard group name","impact":"high","summary":"The WAVLINK WN536AX6-A router firmware does not sanitize the group_name argument in its WireGuard CLI group handler, so input passed there is run as an operating system command. An attacker who can reach the device over the network can run commands on it, and a public exploit has been disclosed.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn536ax6-a","router","wireguard","iot"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs operating system commands on the router remotely","analyst_note":"Confirm whether the WireGuard group handler needs login and whether WAVLINK has released a fixed firmware; check NVD entry for CVSS detail.","how_to_check":"- Check the firmware version on the device admin page; the sources name `V260507_2.0.0` as affected.\n- Check whether the router's management interface or WireGuard functions are reachable from the internet.\n- unknown for any other check; the sources do not give a configuration file or command to inspect.","plain_action":"If you own a WAVLINK WN536AX6-A router, check its firmware version and watch for an update from WAVLINK; the sources do not name a fixed version.","needs_analyst":true,"not_affected_if":["other-firmware-version","no-wireguard-exposure"],"who_is_affected":"Owners of the WAVLINK WN536AX6-A router running firmware V260507_2.0.0 are named in the sources. The flaw is reached through the WireGuard group handling in the device's /bin/ioos binary, so devices with the WireGuard feature exposed to a network are the most relevant. Teams that do not use this model can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000757,"input_tokens":4171,"output_tokens":679,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the WireGuard group handler needs login and whether WAVLINK has released a fixed firmware; check NVD entry for CVSS detail.","search":"'-120277':17A,20A '-2026':16A,19A '/bin/ioos':107C '2.0.0':96C '41a1d8':103C 'a':23A 'affect':99C 'argument':44B,119C 'attack':63B,133C 'cli':48B,112C 'command':6A,61B,74B,125C 'compon':110C 'contact':148C 'cve':15A,18A 'detect':89C 'devic':68B 'disclos':83B,139C 'disclosur':152C 'earli':149C 'exploit':80B,136C 'file':106C 'firmwar':37B 'fix':13A 'function':101C 'group':10A,42B,49B,113C,120C 'handler':50B,114C 'infrastructur':24B 'inject':7A,126C 'input':52B 'iot':25B 'issu':98C 'launch':131C 'lead':122C 'list':14A 'manipul':116C 'may':142C 'name':11A,43B,121C 'network':71B 'oper':59B 'os':124C 'pass':53B 'possibl':129C 'public':79B,140C 'reach':66B 'remot':134C 'router':5A,26B,36B 'run':56B,73B 'sanit':40B 'secur':85C 'sub':102C 'system':60B 'use':144C 'v260507':95C 'vendor':146C 'via':8A 'vulner':86C 'wavlink':1A,27B,32B,91C 'wireguard':9A,28B,47B,111C 'wn536ax6':3A,22A,30B,34B,93C 'wn536ax6-a':2A,21A,29B,33B,92C","nicknames":[],"mitigations":[],"who_affected":"Owners of the WAVLINK WN536AX6-A router on firmware V260507_2.0.0 are affected, according to VulDB. The flaw is in the WireGuard group handler of the web management backend (/bin/ioos). VulDB says no login is needed, but the vendor has not confirmed that. A public proof of concept exists. Anyone not using this model or this firmware version can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you own a WAVLINK WN536AX6-A router, check its firmware version and watch for an update from WAVLINK; the sources do not name a fixed version.","first_public_at":"2026-11-02T00:18:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120277","severity":null,"published_at":"2026-11-02T00:18:10+00:00","modified_at":"2026-11-02T00:18:10+00:00","first_seen_at":"2026-11-02T00:22:57+00:00","fetched_at":"2026-11-02T00:22:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120277:1329","url":null,"severity":null,"published_at":"2026-11-02T00:24:43+00:00","modified_at":"2026-11-02T00:24:43+00:00","first_seen_at":"2026-11-02T00:24:43+00:00","fetched_at":"2026-11-02T00:24:43+00:00","note":"No vendor advisory found; read VulDB VDB-429621 (CNA) and OpenCVE: only V260507_2.0.0 listed, no remediation, PoC on GitHub (link locked). VulDB says no auth needed, but a sibling VulDB submission (919251, other WAVLINK model, same wireguard_cli_group handler) says authenticated; auth unconfirmed. Nothing verified (no primary source)."}],"documents":[{"id":41467,"url":"https://vuldb.com/vuln/429621","title":"VulDB VDB-429621: WAVLINK WN536AX6-A WireGuard CLI Group os command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":41468,"url":"https://vuldb.com/submit/919251","title":"VulDB submit 919251: sibling WAVLINK model, authenticated wireguard_cli_group injection","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}