Live › vulnerability › CVE-2026-120282
The WAVLINK WN536AX6-A router firmware (V260507) passes the mac argument of the host_black function in /protocol.csp to an OS command without sanitizing it. A remote attacker can inject shell commands and run them on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 01:23 UTC. All times on this page are UTC.
Owners of WAVLINK WN536AX6-A routers running firmware V260507. The flaw is in the host_black function of /protocol.csp on the router's web interface, where the mac argument reaches an OS command. VulDB says it can be exploited remotely and a public proof of concept exists, but sources do not say whether login is required or whether the interface is reachable from the internet by default. Other WAVLINK models can skip it unless a source later says otherwise.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN536AX6-A | vendor | V260507 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120282")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.