---
id: "CVE-2026-120277"
kind: "vulnerability"
aliases: ["CVE-2026-120277"]
title: "WAVLINK WN536AX6-A router: command injection via WireGuard group name, no fix listed"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN536AX6-A", "fixed": [], "affected": "V260507_2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "iot", "router", "wavlink", "wireguard", "wn536ax6-a"]
not_affected_if: ["no-wireguard-exposure", "other-firmware-version", "other-model"]
published_at: "2026-11-02T00:18:10+00:00"
first_seen_at: "2026-11-02T00:22:57+00:00"
updated_at: "2026-11-02T00:24:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120277", "first_seen_at": "2026-11-02T00:22:57+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T00:24:43+00:00"}]
---

# WAVLINK WN536AX6-A router: command injection via WireGuard group name, no fix listed

The WAVLINK WN536AX6-A router firmware does not sanitize the group_name argument in its WireGuard CLI group handler, so input passed there is run as an operating system command. An attacker who can reach the device over the network can run commands on it, and a public exploit has been disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN536AX6-A affected V260507_2.0.0 fixed ?

## How to check

- Check the firmware version in the router admin page; V260507_2.0.0 is the only version listed as affected.
- Check whether the web management interface is reachable from the internet or untrusted networks; turn off remote management and the WireGuard server if you do not use them.
- Also check other WAVLINK models: a similar WireGuard group handler flaw was reported on a sibling model (not confirmed affected here).

## Timeline

- 2026-11-02T00:22:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120277
- 2026-11-02T00:24:43+00:00 analyst — No vendor advisory found; read VulDB VDB-429621 (CNA) and OpenCVE: only V260507_2.0.0 listed, no remediation, PoC on GitHub (link locked). VulDB says no auth needed, but a sibling VulDB submission (919251, other WAVLINK model, same wireguard_cli_group handler) says authenticated; auth unconfirmed. Nothing verified (no primary source).

## Documents

- [describes] VulDB VDB-429621: WAVLINK WN536AX6-A WireGuard CLI Group os command injection https://vuldb.com/vuln/429621
- [mentions] VulDB submit 919251: sibling WAVLINK model, authenticated wireguard_cli_group injection https://vuldb.com/submit/919251

## From the sources

A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_