CVE-2026-120280 is a critical OS command injection flaw in the WireGuard component of WAVLINK WN536AX6-A firmware V260507, and a public exploit has been disclosed.
What Is It
The flaw is in the wireguard_cli_group handler in /protocol.csp, part of the device's WireGuard component. Manipulating the group_id or group_name argument leads to OS command injection. The weaknesses are classified as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
VulDB is the CNA and published the record to NVD. NVD lists its status as "Received," which means NVD has not yet completed its own analysis.
Why It Matters
VulDB scores this flaw CVSS 3.1 10.0 (CRITICAL) with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. In plain terms:
- Network-reachable: the attack can be launched remotely.
- Low complexity: no special conditions are needed.
- No privileges or user interaction required: an attacker does not need to log in, and no one has to click anything.
- Scope changed: impact can reach beyond the vulnerable component, with high impact to confidentiality, integrity and availability.
The CVSS 4.0 score is 9.3 (CRITICAL), with exploit maturity rated Proof-of-Concept. The CNA says the exploit "has been disclosed to the public and may be used," and a public write-up is linked in the references.
This CVE has no CISA KEV entry, so active exploitation in the wild is not confirmed. Even so, a public exploit for an unauthenticated, network-reachable command injection flaw makes this a high priority for anyone running the affected device.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN536AX6-A
- Affected version: V260507
- Component: WireGuard (
/protocol.csp,wireguard_cli_grouphandler) - Vulnerable parameters:
group_id,group_name - CPE:
cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:*
The record lists no other firmware versions.
Patch Status
The source material lists no patch, fixed firmware version or vendor advisory. The CNA states that the vendor "was contacted early about this disclosure" but does not record any response. Because there is no KEV entry, CISA has not issued a required action or due date.
Until WAVLINK publishes a fix, owners should check the vendor and VulDB references for updates. They should also consider limiting network exposure of the device's management interface.