---
id: "CVE-2026-120280"
kind: "vulnerability"
aliases: ["CVE-2026-120280"]
title: "WAVLINK WN536AX6-A router: WireGuard group handler command injection, firmware V260507"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN536AX6-A", "fixed": [], "affected": "V260507", "ecosystem": "vendor"}]
ecosystems: []
tags: ["firmware", "infrastructure", "router", "wavlink", "wireguard", "wn536ax6-a"]
not_affected_if: ["admin-password-set", "management-interface-not-exposed", "other-firmware-versions"]
published_at: "2026-11-02T01:17:26+00:00"
first_seen_at: "2026-11-02T01:23:19+00:00"
updated_at: "2026-11-02T01:25:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120280", "first_seen_at": "2026-11-02T01:23:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T01:25:09+00:00"}]
---

# WAVLINK WN536AX6-A router: WireGuard group handler command injection, firmware V260507

The WAVLINK WN536AX6-A router firmware (V260507) has a command injection flaw in its WireGuard group handler, where the group_id or group_name argument is passed to the operating system unchecked. A remote attacker can run operating system commands on the router, and a public exploit has been disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN536AX6-A affected V260507 fixed ?

## How to check

- In the router admin page, check the firmware version against V260507, the only version named as affected.
- Confirm an admin password is set and the web management interface is not reachable from the internet.
- Check WAVLINK's security advisory page for a fixed firmware for the WN536AX6-A.

## Timeline

- 2026-11-02T01:23:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120280
- 2026-11-02T01:25:09+00:00 analyst — Researcher write-up (linked as PoC) says the handler needs a session token, but a factory-default device (no admin password set) issues one without credentials, so default devices are effectively unauthenticated. WAVLINK's advisory index does not list this CVE; no fixed firmware found, so fix stays unknown. Nothing marked verified: no vendor statement read. Exploitation in the wild not seen.

## Documents

- [advisory] VulDB 429624: WAVLINK WN536AX6-A WireGuard wireguard_cli_group os command injection https://vuldb.com/vuln/429624
- [mentions] WAVLINK Security Advisory index (does not list this CVE) https://docs.wavlink.xyz/Security_Advisory/
- [poc] PoC write-up: WN536AX6-A wireguard_cli_group group_id injection https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_group_id.md

## From the sources

A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_