The vulnerability in the WireGuard CLI Group Handler of WAVLINK WN536AX6‑A allows an attacker to manipulate the group_name argument in the sub_41a1d8 function within /bin/ioos, leading to OS command injection. This flaw can be exploited from outside the device, enabling remote execution of arbitrary shell commands without authentication. The weakness is categorized as CWE‑77 and CWE‑78 and carries a CVSS score of 10, indicating a critical severity level.

The affected product is the WAVLINK WN536AX6‑A router running firmware V260507_2.0.0. No other vendors, products, or versions were listed in the current CNA information.

With a CVSS score of 10, the risk of exploitation is considered very high. The EPSS score is not available, so current exploitation probability is unknown, but one can infer that the flaw is remotely exploitable because the description states a remote attack is possible and the exploit has been publicly disclosed. The vulnerability is not yet listed in the CISA KEV catalog, yet the severity and lack of mitigation strongly suggest immediate attention.