---
id: "CVE-2026-120282"
kind: "vulnerability"
aliases: ["CVE-2026-120282"]
title: "WAVLINK WN536AX6-A router: remote command injection via host_black MAC argument"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN536AX6-A", "fixed": [], "affected": "V260507", "ecosystem": "vendor"}]
ecosystems: []
tags: ["home-router", "infrastructure", "router-firmware", "wavlink", "wn536ax6-a"]
not_affected_if: ["other-models", "patched-firmware"]
published_at: "2026-11-02T01:17:27+00:00"
first_seen_at: "2026-11-02T01:23:19+00:00"
updated_at: "2026-11-02T01:24:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120282", "first_seen_at": "2026-11-02T01:23:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T01:24:50+00:00"}]
---

# WAVLINK WN536AX6-A router: remote command injection via host_black MAC argument

The WAVLINK WN536AX6-A router firmware (V260507) passes the mac argument of the host_black function in /protocol.csp to an OS command without sanitizing it. A remote attacker can inject shell commands and run them on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN536AX6-A affected V260507 fixed ?

## How to check

- Check the firmware version in the router admin interface; V260507 (also seen as V260507_2.0.0) is the affected version.
- Make sure the router's web admin interface is not reachable from the internet (disable remote management) and check the WAVLINK security page (https://docs.wavlink.xyz/Security_Advisory/) for a fix; none is listed as of 2026-11-02.
- Also check any other WAVLINK models you run, since sibling flaws were reported in the same firmware family.

## Timeline

- 2026-11-02T01:23:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120282
- 2026-11-02T01:24:50+00:00 analyst — Read VulDB entry (third-party; points to a GitHub advisory/PoC by submitter hackerpipi, not fetched) and WAVLINK's advisory index: this CVE is not listed there, so no vendor fix or statement found. Nothing verified. Auth requirement unconfirmed (CVSS4 vector says PR:L, other WN536AX6-A siblings rated PR:N). PoC public per VulDB; no exploitation reported. Sibling WN536AX6-A CVEs: 120276-120280.

## Documents

- [describes] VulDB: WAVLINK WN536AX6-A V260507 /protocol.csp host_black mac os command injection https://vuldb.com/vuln/429626
- [mentions] WAVLINK Security Advisory index (does not list this CVE) https://docs.wavlink.xyz/Security_Advisory/

## From the sources

A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_