A remotely exploitable OS command injection flaw in the WAVLINK WN536AX6-A web management interface is rated CVSS 10.0, and a public exploit is already available.
What Is It
CVE-2026-120276 is an OS command injection vulnerability (CWE-77, CWE-78) in WAVLINK WN536AX6-A firmware V260507_2.0.0. The flaw is in the function sub_416760 in the /bin/ioos binary, which belongs to the device's Web Management Interface. Manipulating the group_name argument triggers the injection. The researcher's public write-up names the issue an "openvpn_cli_group command injection."
VulDB assigned the CVE number and published the record. NVD lists its status as "Received," so NVD has not done its own analysis yet.
Why It Matters
VulDB's scores put this at the top of the scale:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, exploit maturity marked as Proof-of-Concept
- CVSS 2.0: 10.0
An attacker can launch it over the network without much effort, without logging in, and without anyone on the other end clicking anything. A successful attack can expose data, change it, and knock the device offline, and the damage can spread beyond the vulnerable component itself. According to the advisory, the exploit is public "and could be used for attacks."
This CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm that anyone is exploiting it right now. Still, a public proof-of-concept exists for a router bug that anyone who can reach the device over the network can trigger without logging in. Attackers could realistically start using it in the next few days or weeks.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN536AX6-A
- Affected version: V260507_2.0.0
- Component: Web Management Interface (
/bin/ioos, functionsub_416760) - CPE:
cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:*
The record lists no other versions.
Patch Status
The source data gives no vendor patch, fixed version or official mitigation. The advisory says the vendor was contacted early about the disclosure, but it does not record a response. CISA has published no required action because the CVE is not in KEV.
Until WAVLINK publishes a fix, owners of affected devices should check the vendor references for updates. They should also consider limiting who can reach the web management interface, especially from untrusted networks.