CVE-2026-120279
Received Received - Intake

OS Command Injection in WAVLINK WN536AX6-A V260507

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulDB

Description
A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120279

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WAVLINK WN536AX6-A V260507

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120279 is a command injection flaw in WAVLINK WN536AX6-A routers running firmware V260507. It exists in the openvpn_cli handler of the /protocol.csp file, where the file_id parameter is unsanitized and directly used in a shell command executed via popen(). Attackers can exploit this to inject and execute arbitrary commands with root privileges.

Detection Guidance

To detect this vulnerability, check if your WAVLINK WN536AX6-A router is running firmware version V260507. Verify if passwordless login is enabled by default (FirstLogin=1). Inspect network traffic for requests to /protocol.csp with the file_id parameter. Look for unusual commands executed via popen() in system logs.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary commands on the affected router with root privileges. Since the device ships with passwordless login enabled by default, attackers can bypass authentication to obtain a session token and then inject commands. This could lead to full system compromise, data theft, or further network infiltration.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access and potential data breaches. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A successful exploit could result in unauthorized data access, leading to legal penalties and reputational damage.

Mitigation Strategies

Immediately update the router firmware to a patched version. Disable passwordless login by setting FirstLogin=0. Restrict access to the /protocol.csp endpoint via firewall rules. Monitor for unauthorized command execution in system logs. Consider disabling the openvpn_cli handler if not needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120279. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...