Zero Radar
← feed
CriticalVulnerabilityCVE-2026-120277updated 2 Nov 2026, 00:19 UTC

WAVLINK WN536AX6-A router: remote command injection via WireGuard group name

Attackers can send a specially crafted request to this router and make it run commands they choose. That could let them take over the device.

NewOfficial source
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted group_name value sent to the router
  2. 2Router parses inputsub_41a1d8 in /bin/ioos handles group_name
  3. 3Injected command runsInput is passed to the OS without sanitizing
  4. 4Device compromisedAttacker gains command execution on router
  5. ResultAttacker controls the router

What happened

The function sub_41a1d8 in /bin/ioos, part of the WireGuard CLI Group Handler, does not sanitize the group_name argument, allowing OS command injection that can be triggered remotely.

Why it is dangerous: A successful attacker could run arbitrary commands on the router, potentially taking control of the device and the network behind it. Owners of this router model are at risk.

Are you affected?

You are affected if you run WAVLINK WN536AX6-A with firmware V260507_2.0.0.

WAVLINK WN536AX6-A V260507_2.0.0

What to do

  1. Check WAVLINK's website or support channels for a firmware update that fixes this issue and install it
  2. If no fix is available, restrict access to the router's management interface and disable remote administration
  3. Monitor the device for unexpected settings or behavior until a fix is confirmed

Timeline

  1. 2 Nov 2026, 00:18 UTC
    Publicly disclosed
  2. 2 Nov 2026, 00:18 UTC
    Reported by NVD · NVD
  3. 2 Nov 2026, 00:19 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-120277
CVSS
9.3 / 10
Disclosed
2 Nov 2026, 00:18 UTC
On Zero Radar
2 Nov 2026, 00:19 UTC (1 min after disclosure)
Last change
2 Nov 2026, 00:19 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WAVLINK WN536AX6-A router: remote command injection via WireGuard group name · Zero Radar