CVE-2026-120279 is a critical, remotely exploitable OS command injection flaw in WAVLINK WN536AX6-A firmware V260507, and a public exploit has been released.
What Is It
CVE-2026-120279 is an OS command injection vulnerability in the WAVLINK WN536AX6-A, version V260507. The flaw is in an unspecified function of the /protocol.csp file, inside the openvpn_cli Handler component. An attacker who manipulates the file_id argument can inject operating system commands.
The CNA, VulDB, mapped the flaw to two weaknesses: - CWE-77: Improper Neutralization of Special Elements used in a Command - CWE-78: OS Command Injection
Why It Matters
According to the NVD record, the attack can be launched remotely and the exploit has been published. The scores reflect very low barriers to attack:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It is network-reachable and low-complexity. No privileges or user interaction are needed, the scope is changed, and confidentiality, integrity and availability impacts are all high. - CVSS 4.0: 9.3 CRITICAL. Exploit maturity is rated Proof-of-Concept, and impacts on both the vulnerable system and subsequent systems are high.
- CVSS 2.0: 10.0, with complete confidentiality, integrity and availability impact.
The supplied CISA Known Exploited Vulnerabilities (KEV) entry was empty. That means KEV does not confirm active exploitation in the wild. However, a public proof-of-concept exists, so exposed devices should be treated as at risk.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN536AX6-A
- Affected version: V260507
- Component: openvpn_cli Handler (
/protocol.csp) - Vulnerable parameter:
file_id - CPE:
cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:*
The NVD record is still in "Received" status, so NVD has not yet completed its own analysis.
Patch Status
The supplied data contains no vendor patch, fixed firmware version or official advisory. The description says the vendor was contacted early about the disclosure, but it does not say whether the vendor responded or released a fix. CVE-2026-120279 does not appear in the CISA KEV catalog, so there is no CISA-mandated required action or due date.
Owners of WN536AX6-A devices running V260507 should check WAVLINK directly for updated firmware. Until a fix is confirmed, they should limit network exposure of the device's management interface.