---
id: "CVE-2026-120279"
kind: "vulnerability"
aliases: ["CVE-2026-120279"]
title: "WAVLINK WN536AX6-A router: remote command injection via protocol.csp file_id"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN536AX6-A", "fixed": [], "affected": "V260507", "ecosystem": "vendor"}]
ecosystems: []
tags: ["firmware", "home-router", "infrastructure", "router", "wavlink", "wn536ax6-a"]
not_affected_if: ["no-remote-admin", "not-exposed-to-internet", "other-firmware-versions"]
published_at: "2026-11-02T01:17:26+00:00"
first_seen_at: "2026-11-02T01:23:19+00:00"
updated_at: "2026-11-02T01:25:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120279", "first_seen_at": "2026-11-02T01:23:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T01:25:57+00:00"}]
---

# WAVLINK WN536AX6-A router: remote command injection via protocol.csp file_id

The WAVLINK WN536AX6-A router firmware (V260507) fails to sanitize the file_id argument in its openvpn_cli handler at /protocol.csp. A remote attacker can inject operating system commands and run them on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN536AX6-A affected V260507 fixed ?

## How to check

- Read the firmware version on the router's admin page; V260507 is the only version named as affected, and other versions are unconfirmed.
- Check whether the web admin interface (/protocol.csp) can be reached from the internet or from untrusted networks; turn off remote administration if it can.
- Also check any other WAVLINK model running the same ioos firmware: the WN530BE1-A has a similar file_id injection with an auth bypass (VulnCheck).

## Timeline

- 2026-11-02T01:23:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120279
- 2026-11-02T01:25:57+00:00 analyst — No vendor advisory or fix found; only VulDB (VDB-429623, submitter hackerpipi) says unauthenticated, remote, public PoC on GitHub (link locked). Not exploited in the wild as far as sources say. Sibling WN530BE1-A has the same file_id bug with an auth bypass via a forged IP-FROM header (VulnCheck); not confirmed for WN536AX6-A. Nothing verified: no primary source.

## Documents

- [describes] VulDB VDB-429623: WAVLINK WN536AX6-A V260507 openvpn_cli file_id os command injection https://vuldb.com/vuln/429623
- [mentions] VulnCheck: Wavlink WN530BE1-A unauthenticated command injection, same file_id/ovpn_file handler (different model) https://www.vulncheck.com/advisories/wavlink-wl-wn530be1-a-unauthenticated-os-command-injection-in-ioos-protocol-csp-ovpn-file-handler

## From the sources

A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_