Description
A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Published: 2026-11-02
Score: 10 Critical
EPSS: n/a
KEV: No
Impact: OS Command Injection
Action: Immediate Patch
AI Analysis

Impact

A flaw exists in the wireguard_cli_group handler within the /protocol.csp file of WAVLINK WN536AX6-A firmware V260507, where manipulation of the group_id/group_name parameters permits execution of arbitrary operating system commands. The vulnerability is remote‑able and has been disclosed publicly, meaning attackers can leverage it to compromise the device, elevate privileges, or disrupt service.

Affected Systems

The affected system is the WAVLINK WN536AX6‑A wireless gateway running firmware version V260507. No other vendor or product variants are listed as impacted.

Risk and Exploitability

The CVSS score is 10, indicating critical severity. The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote request to the device’s WireGuard management interface, requiring the attacker to supply crafted group_id or group_name values to trigger command execution. Given the public disclosure and absence of a mitigating patch, the exploitation likelihood is high and the impact could be widespread device compromise.

Generated by OpenCVE AI on November 2, 2026 at 01:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply a firmware upgrade that addresses the command injection in the wireguard_cli_group handler.
  • If an update is not yet available, restrict external access to the device’s management interfaces using firewall rules or VPN gateway restrictions.
  • Continuously monitor device logs for anomalous access patterns targeting the wireguard_cli_group handler and investigate any suspicious activity promptly.

Generated by OpenCVE AI on November 2, 2026 at 01:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 00:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Title WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection
First Time appeared Wavlink
Wavlink wn536ax6-a
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wn536ax6-a
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Wavlink Wn536ax6-a
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-02T00:15:22.183Z

Reserved: 2026-11-01T07:44:13.312Z

Link: CVE-2026-120280

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-02T01:17:26.873

Modified: 2026-11-02T01:17:26.873

Link: CVE-2026-120280

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T01:30:14Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')