Live › vulnerability › CVE-2026-120280
The WAVLINK WN536AX6-A router firmware (V260507) has a command injection flaw in its WireGuard group handler, where the group_id or group_name argument is passed to the operating system unchecked. A remote attacker can run operating system commands on the router, and a public exploit has been disclosed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 01:23 UTC. All times on this page are UTC.
WAVLINK WN536AX6-A routers on firmware V260507 are affected, through the web management interface at /protocol.csp. A researcher reports that routers still in their factory-default state, with no admin password set, can be reached without credentials. Routers whose management interface is not exposed and that have an admin password set carry much less risk. The sources do not say whether WireGuard must be enabled.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN536AX6-A | vendor | V260507 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120280")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.