A critical OS command injection flaw in the host_black function of the WAVLINK WN536AX6-A's /protocol.csp endpoint can be triggered remotely through the mac parameter, and a public exploit has been disclosed.
What Is It
CVE-2026-120282 is an OS command injection vulnerability (CWE-77, CWE-78) in WAVLINK WN536AX6-A firmware version V260507. The bug is in the host_black function of the /protocol.csp file. When an attacker manipulates the mac argument, the device runs OS commands of the attacker's choosing.
VulDB reported the issue as the CNA, and the CVE has now been published to NVD. Its NVD status is currently "Received."
Why It Matters
The CNA scores the flaw 9.9 CRITICAL under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Key points from that score:
- Remote attack: it works over the network with low attack complexity.
- Low privileges needed: the attacker needs low-level access, such as a valid login.
- No user interaction: no one else has to do anything for the attack to work.
- Changed scope: the impact can reach beyond the vulnerable component, with high impact to confidentiality, integrity and availability.
The CVSS 4.0 score is 8.6 HIGH, and its exploit maturity is marked as Proof of Concept. The description says the exploit "has been publicly disclosed and may be utilized." A public write-up is linked in the references.
KEV status: The supplied data has no CISA KEV entry for this CVE, so CISA has not confirmed active exploitation. With a public PoC and remote access, the risk may still rise quickly.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN536AX6-A
- Affected version: V260507
- Affected component:
/protocol.csp, functionhost_black, parametermac
The NVD record lists no other affected versions.
Patch Status
The supplied source material does not name a fixed firmware version or vendor advisory. The CVE description says only that "the vendor was contacted early about this disclosure." It does not say whether the vendor responded.
There is no KEV entry, so no CISA required action or due date applies. Owners of WN536AX6-A devices on V260507 should:
- Check WAVLINK's support channels for updated firmware.
- Restrict access to the device management interface.
- Watch the references below for patch updates.