Zero Radar
← feed
CriticalVulnerabilityCVE-2026-120276updated 2 Nov 2026, 00:19 UTC

WAVLINK WN536AX6-A router web interface can run attacker commands

Attackers on the network can send a crafted request to the router's web settings page and make it run commands on the router. A public exploit exists.

NewOfficial source
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted group_name value sent to web interface
  2. 2Request reaches routerWeb Management Interface receives input remotely
  3. 3Input not sanitizedsub_416760 in /bin/ioos passes it to shell
  4. 4Commands executeOS command runs with router privileges
  5. ResultAttacker controls the router

What happened

The Web Management Interface function sub_416760 in /bin/ioos on WAVLINK WN536AX6-A V260507_2.0.0 does not sanitize the group_name argument, allowing OS command injection that can be triggered remotely.

Why it is dangerous: An attacker who gets command execution on the router can take control of the device and the traffic passing through it. Anyone using this router with its web interface reachable is at risk.

Are you affected?

You are affected if you run WAVLINK WN536AX6-A firmware V260507_2.0.0 with its Web Management Interface reachable over the network.

WAVLINK WN536AX6-A V260507_2.0.0

What to do

  1. Restrict access to the router's web management interface, and do not expose it to the internet.
  2. Check the vendor's site for a firmware update that fixes this issue and install it.
  3. Change default administrator passwords and review the router for unknown settings or accounts.

Timeline

  1. 2 Nov 2026, 00:18 UTC
    Publicly disclosed
  2. 2 Nov 2026, 00:18 UTC
    Reported by NVD · NVD
  3. 2 Nov 2026, 00:19 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-120276
CVSS
9.3 / 10
Disclosed
2 Nov 2026, 00:18 UTC
On Zero Radar
2 Nov 2026, 00:19 UTC (1 min after disclosure)
Last change
2 Nov 2026, 00:19 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WAVLINK WN536AX6-A router web interface can run attacker commands · Zero Radar