Zero Radar
← feed
CriticalVulnerabilityCVE-2026-120280updated 2 Nov 2026, 01:19 UTC

WAVLINK WN536AX6-A router lets remote attackers run system commands

Attackers on the network can send specially crafted requests to this Wi-Fi router and make it run commands they choose. That can give them control of the device.

NewOfficial source
SeverityCriticalCVSS 9.3 of 10
Being exploited?Not knownNo attacks reported so far
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted group_id or group_name value sent remotely
  2. 2Reaches routerRequest hits /protocol.csp WireGuard handler
  3. 3Input not sanitizedArgument passed into a system command
  4. 4Commands executeOS command injection runs on the device
  5. ResultAttacker controls the router

What happened

A command injection flaw in the WireGuard group handler (/protocol.csp, wireguard_cli_group) lets unsanitized group_id or group_name arguments reach OS command execution on WAVLINK WN536AX6-A firmware V260507.

Why it is dangerous: An attacker who can reach the router's management interface may take over the device, potentially altering its traffic or using it to reach other systems. The vendor was contacted early about this disclosure.

Are you affected?

You are affected if you run WAVLINK WN536AX6-A with firmware V260507 and the WireGuard feature is reachable by an attacker.

WAVLINK WN536AX6-A V260507

What to do

  1. Check for a firmware update from WAVLINK for the WN536AX6-A and install it when available
  2. Disable WireGuard on the router and block remote access to its web management interface
  3. Restrict router administration to trusted local devices only

Timeline

  1. 2 Nov 2026, 01:17 UTC
    Publicly disclosed
  2. 2 Nov 2026, 01:17 UTC
    Reported by NVD · NVD
  3. 2 Nov 2026, 01:19 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-120280
CVSS
9.3 / 10
Disclosed
2 Nov 2026, 01:17 UTC
On Zero Radar
2 Nov 2026, 01:19 UTC (2 min after disclosure)
Last change
2 Nov 2026, 01:19 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WAVLINK WN536AX6-A router lets remote attackers run system commands · Zero Radar