Live › vulnerability › CVE-2026-120279
The WAVLINK WN536AX6-A router firmware (V260507) fails to sanitize the file_id argument in its openvpn_cli handler at /protocol.csp. A remote attacker can inject operating system commands and run them on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 01:23 UTC. All times on this page are UTC.
Owners of WAVLINK WN536AX6-A routers on firmware V260507. VulDB says no authentication is needed and a public proof of concept exists, so any router whose web interface can be reached is at risk. Routers with no remote administration and no untrusted users on the LAN are at lower risk. The vendor has not published an advisory, so other versions are unknown.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN536AX6-A | vendor | V260507 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120279")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.