The reported flaw resides in the web management interface of WAVLINK WN536AX6‑A routers. Specifically, the sub_416760 routine in /bin/ioos fails to sanitise the group_name argument, allowing an attacker to inject arbitrary OS commands. This omission can be exploited remotely over the internet, giving a successful attacker complete control over the underlying firmware. The weakness matches CWE‑77 (OS Command Injection) and CWE‑78 (System Command Injection), and the CVSS base score of 10 indicates the potential for full remote code execution.

Affected hardware includes the WAVLINK WN536AX6‑A model running firmware V260507_2.0.0. The capability was discovered in the Web Management Interface component, and the vendor was notified prior to public disclosure. No other firmware versions or models are explicitly mentioned.

The CVSS rating of 10 underscores a critical risk, while the EPSS score is unavailable, suggesting uncertainty about current exploitation prevalence. The vulnerability is not listed in CISA's KEV catalog, yet the public availability of an exploit indicates it could already be in use. Attackers may use the web UI to supply a crafted group_name value, resulting in arbitrary command execution. As the weakness permits full remote code execution, immediate remediation is required.