Zero Radar
← feed
CriticalVulnerabilityCVE-2026-120279updated 2 Nov 2026, 05:42 UTC

WAVLINK WN536AX6-A router: remote command injection flaw

Someone on the internet could send a specially crafted request to this router and make it run commands they choose. That could let them take control of the device.

NewOfficial, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted file_id value sent remotely
  2. 2Request reaches routerTargets /protocol.csp endpoint
  3. 3Input not sanitizedfile_id passed to OS command
  4. 4Command executesInjected OS command runs on device
  5. ResultAttacker runs commands on the router

What happened

A flaw in the openvpn_cli Handler component's /protocol.csp file lets manipulation of the file_id argument cause OS command injection, exploitable remotely.

Why it is dangerous: A remote attacker could fully control the router without logging in, which can expose the home or office network behind it. Anyone running this WAVLINK model is at risk.

Are you affected?

You are affected if you run WAVLINK WN536AX6-A with firmware version V260507.

WAVLINK WN536AX6-A V260507

What to do

  1. Check WAVLINK's site for a firmware update to the WN536AX6-A and install it if available
  2. Restrict remote access to the router's management interface and disable it if not needed
  3. Monitor the device and network for unusual activity until a fix is confirmed

Timeline

  1. 2 Nov 2026, 01:17 UTC
    Publicly disclosed
  2. 2 Nov 2026, 01:17 UTC
    Reported by NVD · NVD
  3. 2 Nov 2026, 01:19 UTC
    Picked up by Zero Radar
  4. 2 Nov 2026, 05:42 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-120279 · GHSA-x3j2-x298-hcr4
CVSS
9.3 / 10
Disclosed
2 Nov 2026, 01:17 UTC
On Zero Radar
2 Nov 2026, 01:19 UTC (2 min after disclosure)
Last change
2 Nov 2026, 05:42 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WAVLINK WN536AX6-A router: remote command injection flaw · Zero Radar