A remotely exploitable OS command injection flaw in the WireGuard CLI Group Handler of WAVLINK WN536AX6-A firmware V260507_2.0.0 has a CVSS 3.1 score of 10.0, and a public exploit is available.
What Is It
CVE-2026-120277 is an OS command injection vulnerability (CWE-77, CWE-78) in the WAVLINK WN536AX6-A router. It is in the function sub_41a1d8 of the /bin/ioos binary, part of the WireGuard CLI Group Handler. An attacker can manipulate the group_name argument to inject operating system commands. The CNA (VulDB) says the attack can be launched remotely.
NVD lists the record's status as "Received," which means NVD has not yet run its own analysis. The scores below come from the CNA.
Why It Matters
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It is network-reachable, has low attack complexity, and needs no privileges or user interaction. Scope is changed, and confidentiality, integrity and availability impacts are all high. - CVSS 4.0: 9.3 CRITICAL, with exploit maturity rated Proof-of-Concept.
- CVSS 2.0: 10.0, with complete impact on confidentiality, integrity and availability.
The exploit has been disclosed publicly, and the CNA says it "may be used." A public write-up is linked in the references. Command injection on an edge router can lead to full device compromise, which puts traffic passing through the device at risk.
None of the sources below says whether CVE-2026-120277 is in CISA's Known Exploited Vulnerabilities (KEV) catalog, and none reports active exploitation in the wild. Defenders should check the KEV catalog directly to find out whether a CISA remediation deadline applies.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN536AX6-A
- Affected version: V260507_2.0.0
- Component: WireGuard CLI Group Handler (
/bin/ioos, functionsub_41a1d8) - Vulnerable parameter:
group_name
The supplied data does not list any other affected firmware versions.
Patch Status
The supplied sources do not mention a vendor patch, fixed firmware version or official workaround. The disclosure says WAVLINK "was contacted early," but it does not record any vendor response. The sources also do not mention any CISA KEV required action.
Owners of the WN536AX6-A on V260507_2.0.0 should watch WAVLINK for a firmware update. Until one is released, they should limit network exposure of the device's management interfaces.