EUVD-2026-114913
GHSA-q3mh-mrr2-xh2h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface (/protocol.csp)
-
DeliverySubmit request to wireguard_cli_group handler
-
ExploitInject shell metacharacters into group_id/group_name
-
ExecutionTrigger OS command injection
-
PersistExecute arbitrary commands on device
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the router's web management service and the ability to invoke the wireguard_cli_group handler of /protocol.csp, then supplying shell metacharacters in the group_id or group_name argument. Per the CVSS vector PR:N, no authentication is required and no user interaction is needed (UI:N). The primary limiting factor is exposure of the management interface: this is typically LAN-facing by default, so remote Internet exploitation depends on the interface being reachable from the WAN (remote administration enabled or the device directly exposed). The specific firmware build identified is V260507; applicability to other builds is not stated in the available source. |
| Impact | This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction, and CWE-78 OS command injection on an embedded router typically yields code execution in a privileged context, which matches the high confidentiality/integrity/availability impact. The vuln.today decision label is 'act_now', reinforcing urgency. However, signals are partially thin: there is NO EPSS score provided, this CVE is NOT listed in CISA KEV, and the PoC is a reference only, not verified as working exploit code - so 'confirmed active exploitation' cannot be claimed. The reporting is single-source (VulDB), and the vendor was only 'contacted early' with no confirmed patch, meaning the fix status is unverified. Net: high intrinsic risk driven by unauthenticated remote command injection on a consumer router, tempered by the absence of exploitation-probability data and unverified PoC maturity. |
| Exploit ScenarioDerived | An attacker with network access to the router's web management interface sends a crafted request to the /protocol.csp WireGuard handler, injecting shell metacharacters into the group_id or group_name argument. Because no authentication is required (PR:N) and complexity is low (AC:L), the injected OS command executes on the device, likely with elevated firmware privileges. A public PoC reference exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 02, 2026
OS command injection in the WAVLINK WN536AX6-A router running firmware V260507 allows remote attackers to run arbitrary shell commands on the device through the WireGuard group configuration handler, with no authentication or user interaction required per the assessed vector (PR:N/UI:N) and a CVSS 4.0 base score of 9.3 reflecting high confidentiality, integrity and availability impact on both the vulnerable system and downstream dependent systems. Exploitation is gated by reachability rather than by credentials: the web management service that exposes /protocol.csp is typically LAN-facing by default, so Internet-side attacks depend on remote administration being enabled or the router being directly exposed. A public proof-of-concept reference targets the group_id and group_name parameters; it is not verified as working exploit code, and no confirmed active exploitation is recorded. vuln.today prioritisation labels this act_now.
Earlier versions of this analysis (1)
Unauthenticated OS command injection in the WAVLINK WN536AX6-A (V260507 firmware) WireGuard handler lets remote attackers execute commands through the /protocol.csp wireguard_cli_group endpoint by controlling the group_id or group_name argument. The CWE-78 flaw is scored 10.0 under CVSS 4.0 and has a public PoC reference that is not verified as working exploit code; no CISA KEV listing is reported. This is a genuine high-priority issue, but practical exploitation depends on reachability of the router's HTTP management interface: LAN/Wi-Fi exposure is the expected SOHO path, while WAN exploitation requires remote management to be enabled, a condition the available sources do not confirm.
RemediationAI
No vendor-released patch was identified at the time of analysis; the vendor was contacted early about the disclosure, so the VulDB entry at https://vuldb.com/vuln/429624 and the CVE record at https://vuldb.com/cve/CVE-2026-120280 should be monitored for a fixed firmware build, and upgrade to that build as soon as WAVLINK publishes it. Until then, the decisive control is exposure reduction, because the attack requires network reachability to the web management service and the ability to invoke the wireguard_cli_group handler: disable remote/WAN administration and UPnP-based port forwarding so the management interface answers only on the LAN, which stops Internet-origin exploitation but breaks legitimate remote administration and any cloud management the router participates in. Where the interface must remain reachable, restrict it to a management VLAN or a fixed set of trusted source addresses via a firewall rule in front of the device (trade-off: management must originate from those hosts or a jump box), and block external access to /protocol.csp specifically. Disable or avoid the WireGuard group configuration features until a fix exists if they are not in active use, accepting loss of that management functionality, and log or alert on requests to /protocol.csp containing shell metacharacters in group_id or group_name parameters. Because the flaw is unauthenticated in the assessed vector, credential hardening and password changes do not mitigate it; only removing reachability or applying a vendor fix does.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-78 operating system command injection in the WireGuard management component of the WAVLINK WN536AX6-A firmware. The affected element is the wireguard_cli_group handler exposed through the /protocol.csp endpoint, which is the device's configuration-service interface used by the web UI to build and dispatch WireGuard CLI operations. User-supplied values for the group_id and group_name arguments are incorporated into a command that is executed by the underlying shell rather than being confined to a data-only parameter, so shell metacharacters in those arguments are interpreted as command syntax and yield execution with the privileges of the configuration service. The supplied sources do not describe the exact string-building or escaping implementation that makes this possible, so the precise concatenation or quoting defect is not documented; what is confirmed is the handler, the endpoint, the two injectable arguments, and the resulting command execution. The CPE entry cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:* carries a wildcard version, while the disclosure names build V260507 specifically; applicability to other firmware builds of the same model is not stated in the available sources and should be treated as unverified.
Know when Wn536Ax6 A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Unauthenticated network-reachable command injection on a router web handler (AV:N/AC:L/PR:N/UI:N) yielding OS command execution, giving full C/I/A impact on the device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Technical POC Analysis
Bug class: CWE-78, OS command injection.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A critical unauthenticated command injection vulnerability in WAVLINK WN536AX6-A routers (firmware V260507) allows remote attackers to fully compromise affected devices and potentially pivot into connected networks. Leadership should prioritize this due to the high likelihood of exploitation once a working exploit emerges, especially for any internet-facing or remote-admin-enabled routers, which could lead to data breaches, operational disruption, and regulatory exposure.
No vendor-released patch identified at time of analysis. Interim mitigations: disable remote administration, restrict management interface access to trusted LAN only, implement network segmentation, and monitor for suspicious outbound traffic.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in WAVLINK WN536AX6-A Command Injection and Buffer Overflow
View all 5More in Wn536Ax6 A
View allOS command injection in the WireGuard CLI group handler of the WAVLINK WN536AX6-A router (firmware V260507_2.0.0) lets a
OS command injection in the WAVLINK WN536AX6-A web management interface allows remote attackers to execute arbitrary she
Exploit-DB