{"id":"CVE-2026-120279","kind":"vulnerability","aliases":["CVE-2026-120279"],"related":[],"title":"WAVLINK WN536AX6-A router: remote command injection via protocol.csp file_id","description":"A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.","summary":"The WAVLINK WN536AX6-A router firmware (V260507) fails to sanitize the file_id argument in its openvpn_cli handler at /protocol.csp. A remote attacker can inject operating system commands and run them on the device.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN536AX6-A","fixed":[],"affected":"V260507","ecosystem":"vendor"}],"ecosystems":[],"tags":["firmware","home-router","infrastructure","router","wavlink","wn536ax6-a"],"not_affected_if":["no-remote-admin","not-exposed-to-internet","other-firmware-versions"],"how_to_check":"- Read the firmware version on the router's admin page; V260507 is the only version named as affected, and other versions are unconfirmed.\n- Check whether the web admin interface (/protocol.csp) can be reached from the internet or from untrusted networks; turn off remote administration if it can.\n- Also check any other WAVLINK model running the same ioos firmware: the WN530BE1-A has a similar file_id injection with an auth bypass (VulnCheck).","fix":null,"status":"open","published_at":"2026-11-02T01:17:26+00:00","first_seen_at":"2026-11-02T01:23:19+00:00","triaged_at":"2026-11-02T01:24:09+00:00","updated_at":"2026-11-02T01:25:57+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-02T01:24:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN536AX6-A router: remote command injection via protocol.csp file_id","impact":"high","summary":"The WAVLINK WN536AX6-A router firmware (V260507) fails to sanitize the file_id argument in its openvpn_cli handler at /protocol.csp. A remote attacker can inject operating system commands and run them on the device.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn536ax6-a","router","home-router","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs operating system commands on the router remotely","analyst_note":"Confirm whether a vendor fix exists and whether authentication is required for /protocol.csp, using the NVD entry and WAVLINK's advisory channels.","how_to_check":"- Check the firmware version on the router's admin page against `V260507`\n- Confirm whether the openvpn_cli handler is reachable from outside the network","plain_action":"If you use a WAVLINK WN536AX6-A router, check its firmware version and wait for WAVLINK to publish a fix before relying on it for remote access.","needs_analyst":true,"not_affected_if":["other-firmware-versions","no-remote-admin","not-exposed-to-internet"],"who_is_affected":"Owners of WAVLINK WN536AX6-A routers running firmware V260507 are exposed, most seriously if the router's web interface or the vulnerable handler can be reached from the internet. Devices kept behind a restricted network with no remote administration are at lower risk. The sources do not say which other firmware versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000727,"input_tokens":4136,"output_tokens":626,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether a vendor fix exists and whether authentication is required for /protocol.csp, using the NVD entry and WAVLINK's advisory channels.","search":"'-120279':15A,18A '-2026':14A,17A '/protocol.csp':52B,88C 'a':21A 'affect':79C 'argument':45B,100C 'attack':55B,110C 'cli':49B,93C 'command':7A,60B,107C 'compon':91C 'contact':127C 'cve':13A,16A 'devic':66B 'disclosur':131C 'earli':128C 'element':80C 'execut':95C 'exploit':116C 'fail':39B 'file':11A,43B,87C,101C 'firmwar':22B,37B 'flaw':68C 'found':71C 'function':84C 'handler':50B,94C 'home':24B 'home-rout':23B 'id':12A,44B,102C 'infrastructur':26B 'inject':8A,57B,108C 'launch':113C 'lead':104C 'manipul':97C 'may':121C 'openvpn':48B,92C 'oper':58B 'os':106C 'protocol.csp':10A 'publish':119C 'remot':6A,54B,114C 'router':5A,25B,27B,36B 'run':62B 'sanit':41B 'system':59B 'unknown':83C 'use':123C 'v260507':38B,77C 'vendor':125C 'via':9A 'wavlink':1A,28B,32B,73C 'wn536ax6':3A,20A,30B,34B,75C 'wn536ax6-a':2A,19A,29B,33B,74C","nicknames":[],"mitigations":[],"who_affected":"Owners of WAVLINK WN536AX6-A routers on firmware V260507. VulDB says no authentication is needed and a public proof of concept exists, so any router whose web interface can be reached is at risk. Routers with no remote administration and no untrusted users on the LAN are at lower risk. The vendor has not published an advisory, so other versions are unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use a WAVLINK WN536AX6-A router, turn off remote administration in its settings and watch WAVLINK's site for a firmware update.","first_public_at":"2026-11-02T01:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120279","severity":null,"published_at":"2026-11-02T01:17:26+00:00","modified_at":"2026-11-02T01:17:26+00:00","first_seen_at":"2026-11-02T01:23:19+00:00","fetched_at":"2026-11-02T01:23:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120279:1336","url":null,"severity":null,"published_at":"2026-11-02T01:25:57+00:00","modified_at":"2026-11-02T01:25:57+00:00","first_seen_at":"2026-11-02T01:25:57+00:00","fetched_at":"2026-11-02T01:25:57+00:00","note":"No vendor advisory or fix found; only VulDB (VDB-429623, submitter hackerpipi) says unauthenticated, remote, public PoC on GitHub (link locked). Not exploited in the wild as far as sources say. Sibling WN530BE1-A has the same file_id bug with an auth bypass via a forged IP-FROM header (VulnCheck); not confirmed for WN536AX6-A. Nothing verified: no primary source."}],"documents":[{"id":41695,"url":"https://vuldb.com/vuln/429623","title":"VulDB VDB-429623: WAVLINK WN536AX6-A V260507 openvpn_cli file_id os command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1881,"url":"https://www.vulncheck.com/advisories/wavlink-wl-wn530be1-a-unauthenticated-os-command-injection-in-ioos-protocol-csp-ovpn-file-handler","title":"VulnCheck: Wavlink WN530BE1-A unauthenticated command injection, same file_id/ovpn_file handler (different model)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}