WAVLINK WN536AX6-A CVE-2026-120279

Exploitation requires network reachability to the device's web management service and specifically the /protocol.csp endpoint invoking the openvpn_cli handler, which processes the file_id argument vulnerable to command injection. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is indicated as required. The practical limiting factor is exposure of that web interface: on consumer routers it is typically bound to the LAN, so internet-wide exploitation depends on remote management (WAN-side admin access) being enabled or the attacker already having a LAN foothold. The condition is the reachable openvpn_cli handler accepting the manipulated file_id parameter; no non-default feature beyond the handler being present and reachable is stated in the available sources.

Multiple signals point the same direction here, which raises confidence despite thin sourcing. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw needing no authentication and no user interaction, with high confidentiality, integrity, and availability impact - consistent with OS command injection (CWE-78) that yields code execution on the device. The vuln.today Decision label is act_now, which aligns with that severity. The one counter-signal is exploit maturity: the input marks the PoC as a reference only, not verified as working exploit code (E:P / Proof-of-Concept in the vector), and there is no CISA KEV listing and no EPSS score supplied. So this is genuinely a high-real-risk issue by mechanism and reachability, but 'confirmed active exploitation' is NOT supported by the data - a public PoC reference exists but has not been verified as a working exploit, and no evidence of in-the-wild use is present. The tempering factor on real-world risk is footprint and exposure: WAVLINK consumer routers are a niche product and the vulnerable web handler is normally LAN-facing unless remote management is enabled. Net: treat as high priority to patch where these devices exist, but the blast radius is bounded by the product's limited deployment rather than by exploit difficulty.

A remote attacker who can reach the device's web management interface sends a crafted request to /protocol.csp targeting the openvpn_cli handler with a malicious file_id argument, injecting shell metacharacters that the handler passes to an OS command. This executes attacker-controlled commands on the router with the privileges of the web service (typically root on such embedded devices), granting full device takeover. A public PoC reference exists (GitHub) but is not verified as working exploit code.