CVE-2026-120277
Received Received - Intake

Command Injection in WAVLINK WN536AX6-A V260507 Firmware

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulDB

Description
A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120277

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WAVLINK WN536AX6-A V260507_2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120277 is an unauthenticated OS command injection flaw in the WAVLINK WN536AX6-A router's WireGuard CLI Group Handler. The vulnerability exists in the /bin/ioos file where the group_name parameter is passed unsanitized to a system() call, allowing attackers to inject malicious commands with root privileges.

Detection Guidance

Check if the WAVLINK WN536AX6-A router is exposed to the internet or has default factory settings with an empty password. Scan for open port 81 on the device to detect potential access to the ioos service. Test for command injection by sending a crafted payload like 'a';id;' to the group_name parameter in WireGuard CLI Group Handler.

Impact Analysis

This vulnerability enables remote attackers to execute arbitrary commands on the device with root privileges. Potential impacts include full device compromise, credential theft, unauthorized network access, and persistent backdooring of the router.

Mitigation Strategies

Disable remote access to the router's admin interface if not needed. Change the default password to a strong one. Update the router firmware to the latest version if a patch is available. Block external access to port 81 on the device. Monitor network traffic for suspicious activity targeting the ioos service.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120277. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...