This vulnerability allows attackers to inject arbitrary operating‑system commands by manipulating the file_id parameter in the openvpn_cli handler of WAVLINK WN536AX6‑A. Because the flaw exists in a web‑exposed component, an attacker can trigger it remotely, leading to full control over the device. The associated weak points are OS command injection (CWE‑77) and unsuitable input handling (CWE‑78). The high CVSS score of 10 reflects the potential for severe impact, including loss of confidentiality, integrity, and availability.

The flaw affects the WAVLINK WN536AX6‑A router running firmware V260507. No other vendor or product versions are mentioned.

The CVSS metric indicates that the vulnerability is critical, and a public exploit has already been published. The EPSS score is not available, but the lack of a KEV listing does not diminish the risk; the exploit is usable and can be launched over the network. Attackers can exercise the vulnerable endpoint without local access, suggesting a high likelihood of exploitation when the router’s openvpn_cli interface is reachable from external networks.