EUVD-2026-114915
GHSA-7888-qfjf-w47r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface (AV:N)
-
DeliveryAuthenticate with low-privilege credentials (PR:L)
-
ExploitSend crafted /protocol.csp host_black request with malicious mac
-
ExecutionInject shell metacharacters into OS command (CWE-78)
-
PersistExecute arbitrary commands on device
-
ImpactFull compromise of router (C:H/I:H/A:H)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the host_black function accessible via the /protocol.csp endpoint on the WAVLINK WN536AX6-A (firmware V260507); the attacker must be able to send a request to this endpoint with a controlled mac argument. The CVSS vector's PR:L means a low-privileged authenticated session (or reachable credentialed/default-login state) on the router's management interface is required - it is not unauthenticated against default config. The main limiting factors are therefore (1) this authentication/management-access requirement and (2) the need for network reachability to the device's web interface, which on properly segmented deployments is LAN-side rather than exposed to the internet; the specific affected model and firmware further narrow applicability. The sources do not describe the exact injection syntax or which shell metacharacters trigger it beyond identifying the mac argument as the sink. |
| Impact | This is a CWE-78 OS command injection in the host_black function of /protocol.csp on the WAVLINK WN536AX6-A router (firmware V260507), reached via the mac argument. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 8.6 and indicates network-reachable, low-complexity exploitation requiring low privileges (PR:L), i.e. an authenticated session rather than fully anonymous access; the full C/I/A and subsequent-system impacts are rated High, consistent with full device takeover. Exploitation status is a public PoC reference only - the input lists a GitHub exploit reference but marks it 'reference only, not verified as working exploit code,' so a public PoC reference exists but it is not verified as working exploit code. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of confirmed active exploitation and no quantitative exploitation-probability signal to weigh. The vuln.today Decision label is 'this_week,' indicating a near-term (non-emergency) priority. Net: a genuinely high-impact device-compromise flaw with a disclosed PoC and low technical bar, tempered by the PR:L authentication requirement and the limited real-world footprint of this specific consumer router model; treat it as a prioritize-this-week item for anyone running the affected device, not a drop-everything emergency absent KEV/EPSS data. |
| Exploit ScenarioDerived | An attacker with access to the router's web/management interface sends a crafted request to /protocol.csp targeting the host_black function with a malicious mac parameter, injecting shell metacharacters that the device executes as OS commands. Because CVSS specifies PR:L, this presumes a low-privileged authenticated session (or a device left at default/weak credentials) rather than fully anonymous access. A public PoC reference is published on GitHub, lowering the effort to reproduce, though it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 02, 2026
OS command injection in the WAVLINK WN536AX6-A Wi-Fi router (firmware V260507) allows an attacker who can reach the device's web management interface to execute arbitrary operating-system commands through the mac argument handled by the host_black function of /protocol.csp. The CVSS v4.0 vector reports PR:L, so exploitation requires a low-privileged authenticated management session (or reachable credentialed/default-login state) rather than being unauthenticated against a default configuration, and it additionally requires network reachability to the router's web UI, which on properly segmented networks is LAN-side only. A public PoC reference has been published on GitHub; it is not verified as working exploit code, there is no CISA KEV entry, and the vendor was contacted prior to disclosure. Priority guidance places remediation in the current week.
Earlier versions of this analysis (1)
OS command injection in the host_black functionality of the WAVLINK WN536AX6-A router (firmware V260507) lets an attacker who can reach the /protocol.csp management endpoint inject arbitrary commands through the 'mac' argument. The CVSS 4.0 score is 9.4 and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact, meaning a low-privilege authenticated session (or default credentials) is required before exploitation, which is the main limiting factor rather than full unauthenticated access. A public proof-of-concept reference has been published on GitHub, though it is not verified as working exploit code, and the finding is rated act_now by vuln.today priority scoring; no CISA KEV entry or EPSS score was supplied with this data.
RemediationAI
No vendor-released patch identified at time of analysis; the vendor was contacted early about the disclosure, so affected operators should track the VulDB advisory (https://vuldb.com/vuln/429626) and the CVE record (https://vuldb.com/cve/CVE-2026-120282) for a firmware update and apply it as soon as WAVLINK publishes one for the WN536AX6-A. Until then, the practical controls follow directly from the exploitation prerequisites: keep the router's web management interface off the WAN and reachable only from a trusted management VLAN or LAN segment, which removes the remote path but requires re-architecture if remote administration is currently relied upon; change default and shared administrative credentials and audit who holds low-privileged management accounts, since the assessed vector requires an authenticated session and reducing the number of such sessions shrinks the attack surface at the cost of convenience; and, where logging is available, alert on requests to /protocol.csp whose mac argument contains shell metacharacters or otherwise non-MAC-shaped values, which can detect attempts but will not block a determined authenticated attacker. Updating the firmware remains the only complete fix, and compensating controls should be treated as containment rather than remediation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-78 operating-system command injection: user-supplied input reaching the host_black function of the /protocol.csp handler (the MAC-address blacklist feature) is incorporated into a shell command without adequate neutralisation, so shell metacharacters embedded in the mac argument can break out and run arbitrary commands with the router's web-server privileges. The CPE string cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:* identifies the WAVLINK WN536AX6-A as the affected platform with no version constraint published, and the disclosure specifically names firmware V260507, indicating an embedded Linux-style firmware web stack rather than a generic application server. The supplied sources do not describe the exact injection syntax, which metacharacters are filtered, or the precise command construction, so the trigger mechanics beyond the mac argument being the sink are not described in the available sources. Because the endpoint sits on the router management plane, exploitability is gated by both an authenticated session and network position relative to the device.
Know when Wn536Ax6 A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable management endpoint (AV:N/AC:L), PR:L for the authenticated session implied by the vendor vector, and OS command injection yields full device code execution (C/I/A:H).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Technical POC Analysis
CWE-78 OS command injection, in the ioos web backend handler for hostblack in /protocol.csp, reached via fname=net&opt=hostblack&function=set&....
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A high-severity OS command injection vulnerability in WAVLINK WN536AX6-A Wi-Fi routers (firmware V260507) allows an authenticated attacker with network access to the router's web interface to execute arbitrary commands on the device. Because these routers are often deployed in small offices and remote sites without network segmentation, a compromised device could serve as a foothold for lateral movement into the broader corporate network. Leadership should prioritize remediation to prevent potential unauthorized access to internal resources.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting web management interface access to trusted networks, disabling remote management, changing default credentials, and segmenting affected devices from critical assets.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Related Vulnerabilities in WAVLINK WN536AX6-A Command Injection and Buffer Overflow
View all 5More in Wn536Ax6 A
View allOS command injection in the WireGuard CLI group handler of the WAVLINK WN536AX6-A router (firmware V260507_2.0.0) lets a
OS command injection in the WAVLINK WN536AX6-A web management interface allows remote attackers to execute arbitrary she
Exploit-DB