{"id":"CVE-2026-120280","kind":"vulnerability","aliases":["CVE-2026-120280"],"related":[],"title":"WAVLINK WN536AX6-A router: WireGuard group handler command injection, firmware V260507","description":"A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","summary":"The WAVLINK WN536AX6-A router firmware (V260507) has a command injection flaw in its WireGuard group handler, where the group_id or group_name argument is passed to the operating system unchecked. A remote attacker can run operating system commands on the router, and a public exploit has been disclosed.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN536AX6-A","fixed":[],"affected":"V260507","ecosystem":"vendor"}],"ecosystems":[],"tags":["firmware","infrastructure","router","wavlink","wireguard","wn536ax6-a"],"not_affected_if":["admin-password-set","management-interface-not-exposed","other-firmware-versions"],"how_to_check":"- In the router admin page, check the firmware version against V260507, the only version named as affected.\n- Confirm an admin password is set and the web management interface is not reachable from the internet.\n- Check WAVLINK's security advisory page for a fixed firmware for the WN536AX6-A.","fix":null,"status":"open","published_at":"2026-11-02T01:17:26+00:00","first_seen_at":"2026-11-02T01:23:19+00:00","triaged_at":"2026-11-02T01:24:08+00:00","updated_at":"2026-11-02T01:25:09+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-02T01:24:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN536AX6-A router: WireGuard handler lets remote users run OS commands","impact":"high","summary":"The WAVLINK WN536AX6-A router firmware (V260507) has a command injection flaw in its WireGuard group handler, where the group_id or group_name argument is passed to the operating system unchecked. A remote attacker can run operating system commands on the router, and a public exploit has been disclosed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn536ax6-a","router","wireguard","firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs operating system commands on the router remotely","analyst_note":"Confirm whether authentication is required for /protocol.csp and whether WireGuard must be enabled, and check for a vendor firmware fix; the NVD entry does not say.","how_to_check":"- Check the firmware version in the router admin interface against `V260507`\n- Look for WireGuard group settings exposed on the router's web management interface\n- unknown for anything beyond this","plain_action":"","needs_analyst":true,"not_affected_if":["other-firmware-versions","management-interface-not-exposed"],"who_is_affected":"Any WAVLINK WN536AX6-A router running firmware V260507 with the web management interface reachable is exposed, since the flaw is in the web handler at /protocol.csp. Devices with the management interface restricted to a trusted internal network carry less risk. The sources do not say whether WireGuard must be enabled for the handler to be reachable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00072,"input_tokens":4151,"output_tokens":610,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether authentication is required for /protocol.csp and whether WireGuard must be enabled, and check for a vendor firmware fix; the NVD entry does not say.","search":"'-120280':15A,18A '-2026':14A,17A '/protocol.csp':104C 'a':21A 'argument':54B,113C 'attack':64B,122C 'cli':98C 'command':9A,39B,69B,119C 'compon':107C 'contact':142C 'cve':13A,16A 'disclos':79B,131C 'disclosur':146C 'earli':143C 'element':93C 'exploit':76B,128C 'file':103C 'firmwar':11A,22B,35B 'flaw':41B 'found':84C 'function':96C 'group':7A,45B,49B,52B,99C,114C 'handler':8A,46B,100C 'id':50B 'id/group_name':115C 'impact':92C 'infrastructur':23B 'initi':125C 'inject':10A,40B,120C 'lead':116C 'manipul':110C 'may':123C,136C 'name':53B 'oper':59B,67B 'os':118C 'pass':56B 'public':75B,134C 'remot':63B,126C 'router':5A,24B,34B,72B 'run':66B 'system':60B,68B 'uncheck':61B 'use':138C 'v260507':12A,36B,90C 'vendor':140C 'vulner':81C 'wavlink':1A,25B,30B,86C 'wireguard':6A,26B,44B,97C,108C 'wn536ax6':3A,20A,28B,32B,88C 'wn536ax6-a':2A,19A,27B,31B,87C","nicknames":[],"mitigations":[],"who_affected":"WAVLINK WN536AX6-A routers on firmware V260507 are affected, through the web management interface at /protocol.csp. A researcher reports that routers still in their factory-default state, with no admin password set, can be reached without credentials. Routers whose management interface is not exposed and that have an admin password set carry much less risk. The sources do not say whether WireGuard must be enabled.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-11-02T01:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-120280","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120280","severity":null,"published_at":"2026-11-02T01:17:26+00:00","modified_at":"2026-11-02T01:17:26+00:00","first_seen_at":"2026-11-02T01:23:19+00:00","fetched_at":"2026-11-02T01:23:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120280:1335","url":null,"severity":null,"published_at":"2026-11-02T01:25:09+00:00","modified_at":"2026-11-02T01:25:09+00:00","first_seen_at":"2026-11-02T01:25:09+00:00","fetched_at":"2026-11-02T01:25:09+00:00","note":"Researcher write-up (linked as PoC) says the handler needs a session token, but a factory-default device (no admin password set) issues one without credentials, so default devices are effectively unauthenticated. WAVLINK's advisory index does not list this CVE; no fixed firmware found, so fix stays unknown. Nothing marked verified: no vendor statement read. Exploitation in the wild not seen."}],"documents":[{"id":41683,"url":"https://vuldb.com/vuln/429624","title":"VulDB 429624: WAVLINK WN536AX6-A WireGuard wireguard_cli_group os command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":41687,"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_group_id.md","title":"PoC write-up: WN536AX6-A wireguard_cli_group group_id injection","kind":"poc","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":39242,"url":"https://docs.wavlink.xyz/Security_Advisory/","title":"WAVLINK Security Advisory index (does not list this CVE)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}