{"id":"CVE-2026-120282","kind":"vulnerability","aliases":["CVE-2026-120282"],"related":[],"title":"WAVLINK WN536AX6-A router: remote command injection via host_black MAC argument","description":"A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.","summary":"The WAVLINK WN536AX6-A router firmware (V260507) passes the mac argument of the host_black function in /protocol.csp to an OS command without sanitizing it. A remote attacker can inject shell commands and run them on the device.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN536AX6-A","fixed":[],"affected":"V260507","ecosystem":"vendor"}],"ecosystems":[],"tags":["home-router","infrastructure","router-firmware","wavlink","wn536ax6-a"],"not_affected_if":["other-models","patched-firmware"],"how_to_check":"- Check the firmware version in the router admin interface; V260507 (also seen as V260507_2.0.0) is the affected version.\n- Make sure the router's web admin interface is not reachable from the internet (disable remote management) and check the WAVLINK security page (https://docs.wavlink.xyz/Security_Advisory/) for a fix; none is listed as of 2026-11-02.\n- Also check any other WAVLINK models you run, since sibling flaws were reported in the same firmware family.","fix":null,"status":"open","published_at":"2026-11-02T01:17:27+00:00","first_seen_at":"2026-11-02T01:23:19+00:00","triaged_at":"2026-11-02T01:24:12+00:00","updated_at":"2026-11-02T01:24:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-02T01:24:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"WAVLINK WN536AX6-A router: remote command injection via host_black MAC argument","impact":"high","summary":"The WAVLINK WN536AX6-A router firmware (V260507) passes the mac argument of the host_black function in /protocol.csp to an OS command without sanitizing it. A remote attacker can inject shell commands and run them on the device.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn536ax6-a","home-router","router-firmware"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary operating system commands on the router","analyst_note":"Confirm whether the vendor has released a fix and whether authentication is required to reach /protocol.csp; sources only list NVD.","how_to_check":"- Check the firmware version on the router's admin interface against `V260507`\n- Confirm whether `/protocol.csp` is reachable from the network the router serves","plain_action":"If you own a WAVLINK WN536AX6-A router, check its firmware version and watch for a vendor update, since the sources state no fix yet.","needs_analyst":true,"not_affected_if":["other-models","patched-firmware"],"who_is_affected":"Owners and administrators of WAVLINK WN536AX6-A routers running firmware V260507, where the vulnerable web endpoint is exposed. Sources do not say whether the flaw is reachable from the internet by default or only from the local network. Teams that do not run this model can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000706,"input_tokens":4132,"output_tokens":586,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the vendor has released a fix and whether authentication is required to reach /protocol.csp; sources only list NVD.","search":"'-120282':16A,19A '-2026':15A,18A '/protocol.csp':51B,91C 'a':22A 'argument':13A,44B,96C 'attack':61B,106C 'black':11A,48B,87C 'caus':98C 'command':7A,55B,65B,100C 'contact':122C 'cve':14A,17A 'determin':75C 'devic':71B 'disclos':114C 'disclosur':126C 'earli':123C 'exploit':103C,110C 'file':90C 'firmwar':29B,39B 'function':49B,85C 'home':24B 'home-rout':23B 'host':10A,47B,86C 'impact':83C 'infrastructur':26B 'inject':8A,63B,101C 'mac':12A,43B,97C 'manipul':93C 'may':116C 'os':54B,99C 'pass':41B 'possibl':108C 'public':113C 'remot':6A,60B,102C 'router':5A,25B,28B,38B 'router-firmwar':27B 'run':67B 'sanit':57B 'shell':64B 'util':118C 'v260507':40B,81C 'vendor':120C 'via':9A 'vulner':73C 'wavlink':1A,30B,34B,77C 'without':56B 'wn536ax6':3A,21A,32B,36B,79C 'wn536ax6-a':2A,20A,31B,35B,78C","nicknames":[],"mitigations":[],"who_affected":"Owners of WAVLINK WN536AX6-A routers running firmware V260507. The flaw is in the host_black function of /protocol.csp on the router's web interface, where the mac argument reaches an OS command. VulDB says it can be exploited remotely and a public proof of concept exists, but sources do not say whether login is required or whether the interface is reachable from the internet by default. Other WAVLINK models can skip it unless a source later says otherwise.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you own a WAVLINK WN536AX6-A router, turn off remote access to its admin page and check WAVLINK's website for a firmware update, as none is announced yet.","first_public_at":"2026-11-02T01:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120282","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120282","severity":null,"published_at":"2026-11-02T01:17:27+00:00","modified_at":"2026-11-02T01:17:27+00:00","first_seen_at":"2026-11-02T01:23:19+00:00","fetched_at":"2026-11-02T01:23:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120282:1333","url":null,"severity":null,"published_at":"2026-11-02T01:24:50+00:00","modified_at":"2026-11-02T01:24:50+00:00","first_seen_at":"2026-11-02T01:24:50+00:00","fetched_at":"2026-11-02T01:24:50+00:00","note":"Read VulDB entry (third-party; points to a GitHub advisory/PoC by submitter hackerpipi, not fetched) and WAVLINK's advisory index: this CVE is not listed there, so no vendor fix or statement found. Nothing verified. Auth requirement unconfirmed (CVSS4 vector says PR:L, other WN536AX6-A siblings rated PR:N). PoC public per VulDB; no exploitation reported. Sibling WN536AX6-A CVEs: 120276-120280."}],"documents":[{"id":41680,"url":"https://vuldb.com/vuln/429626","title":"VulDB: WAVLINK WN536AX6-A V260507 /protocol.csp host_black mac os command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":39242,"url":"https://docs.wavlink.xyz/Security_Advisory/","title":"WAVLINK Security Advisory index (does not list this CVE)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}