EUVD-2026-114906
GHSA-jxgh-x37p-hq3v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router Web Management Interface
-
DeliverySubmit crafted group_name parameter
-
ExploitTrigger command injection in /bin/ioos sub_416760
-
ExecutionExecute OS commands on device
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must be able to send a request to the device's Web Management Interface and supply a value for the group_name argument tied to OpenVPN CLI configuration, which is passed unsanitized into a shell command in sub_416760 within /bin/ioos. Exploitation is constrained to the specific affected firmware (WN536AX6-A V260507_2.0.0) and requires network reachability to the management interface - on typical deployments this interface is LAN-facing rather than exposed to the public Internet, which limits remote reach. The vector claims no authentication (PR:N); whether the management interface in fact requires a prior login before the vulnerable OpenVPN configuration endpoint can be reached is not confirmed in the available sources and would meaningfully change real-world exploitability. |
| Impact | Multiple signals converge on genuinely high real-world risk for this specific device. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity attack with no authentication and no user interaction required, and full high impact to confidentiality, integrity and availability - consistent with OS command injection (CWE-78) yielding device takeover. The vuln.today decision label is act_now and CVSS 4.0 exploit maturity is E:P (proof-of-concept), which aligns with the input stating a public PoC reference exists. However, that PoC is a reference only and is NOT verified as working exploit code, so the 'weaponized' bar is not met. This CVE is NOT listed in CISA KEV and no EPSS score was provided in the input, so there is no evidence of widespread active exploitation - the act_now priority rests on the severity and PoC existence rather than confirmed in-the-wild use. One signal to verify: the vector asserts PR:N (unauthenticated), yet the affected surface is a router Web Management Interface where management access is often gated by a login; this PR:N claim comes from VulDB and is not independently confirmed from a vendor advisory. Net: treat as a high-priority patch/mitigation item for anyone operating this exact WAVLINK model, while recognizing the limited deployment footprint caps aggregate risk. |
| Exploit ScenarioDerived | An attacker able to reach the WAVLINK WN536AX6-A Web Management Interface submits a crafted value in the group_name argument (an OpenVPN CLI configuration parameter) that is passed unsafely to a shell in the sub_416760 routine of /bin/ioos, causing arbitrary OS commands to run on the router. Given AV:N/AC:L/PR:N/UI:N, a single crafted request could suffice; a public PoC reference exists but is not verified as working exploit code, so reliability of a turnkey exploit is unconfirmed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 02, 2026
OS command injection in the WAVLINK WN536AX6-A web management interface allows remote attackers to execute arbitrary shell commands as the device's ioos process by supplying a crafted group_name value to the OpenVPN CLI configuration handler (sub_416760 in /bin/ioos). Firmware V260507_2.0.0 is the version identified as affected in the disclosure, and the CVSS 4.0 score of 9.3 with a PR:N vector treats the endpoint as reachable without authentication, although the available sources do not confirm whether a prior login to the management UI is enforced before the vulnerable handler can be reached. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is associated with this CVE, and the vuln.today decision label for the issue is act_now based on the convergence of the command-injection impact, the public write-up, and the absence of a shipped fix.
Earlier versions of this analysis (1)
OS command injection in WAVLINK WN536AX6-A firmware V260507_2.0.0 allows remote, unauthenticated attackers to execute arbitrary shell commands on the router through the web management interface. The vulnerable path is the OpenVPN client configuration handling, where the group_name argument reaches sub_416760 in /bin/ioos; exploitation requires the management interface to be reachable, so WAN or untrusted-network exposure sharply raises risk. A public PoC reference exists but is not verified as working exploit code, and the issue carries an act_now priority based on the unauthenticated 10.0-severity command injection.
RemediationAI
No vendor-released patch is identified at the time of analysis: the disclosure records only that the vendor was contacted early about the issue, and none of the supplied references point to fixed firmware, a release note, or a download for WN536AX6-A. Owners of WN536AX6-A units on V260507_2.0.0 should watch the VulDB entry at https://vuldb.com/vuln/429620 and the CVE record at https://vuldb.com/cve/CVE-2026-120276 for a fixed build and apply it as soon as WAVLINK publishes one, and should verify the installed firmware version directly rather than assuming the wildcard CPE means only one release is at risk. Because the assessed exploitation path requires network reachability to the Web Management Interface, the concrete interim control is to restrict that interface to trusted management hosts - place the device on a dedicated segment, block management-plane access from untrusted VLANs and any WAN-side exposure, and remove port forwards that publish the admin UI. The trade-off is that remote administration and cloud/app-based management paths that rely on that reachability will stop working until access is re-permitted from an approved host. Until a fix exists, avoid using the web interface's OpenVPN CLI group configuration (the group_name field handled by sub_416760) on affected units, since that is the specific input path the public write-up targets; this costs the ability to configure OpenVPN groups through the UI and may require staging that configuration another way or deferring it. Given the act_now priority label, treat any WN536AX6-A whose management interface is reachable from an untrusted network as exposed and prioritize isolating it.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the embedded firmware of a consumer-grade WAVLINK WN536AX6-A router, where the /bin/ioos binary implements the device's web management and service-control logic. Within that binary, function sub_416760 handles configuration of the OpenVPN CLI feature and takes the group_name argument from the management interface; the value is passed into a shell invocation without sanitization, which places the flaw squarely in CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Because the injection occurs in a daemon that runs with the device's own privileges, successful exploitation yields command execution in the context of ioos rather than a sandboxed web process, which is consistent with the high confidentiality, integrity and availability ratings in both vectors. The CPE cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*: uses a wildcard version, so the CPE does not itself enumerate which firmware builds are vulnerable; the human-readable disclosure pins the tested and affected build to V260507_2.0.0. Scoring differs between sources: the CNA-style CVSS 4.0 vector is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N with high subsequent-system impact), while the independent assessment uses CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Neither vector encodes anything about the trigger beyond the untrusted group_name value, and the sources do not describe any additional preconditions inside the handler such as CSRF tokens, session checks, or request formatting requirements. The practical gate is reachability of the management interface: on typical deployments that interface is LAN-facing rather than Internet-exposed, and whether the OpenVPN CLI endpoint can be hit pre-authentication is not established in the available material, so real-world exposure depends heavily on how the device is deployed and segmented.
Know when Wn536Ax6 A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable, low-complexity command injection giving full device code execution with no user interaction; PR:N follows the source vector though management-interface auth is unverified, so could be PR:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Technical POC Analysis
CWE-78 OS command injection in the WAVLINK ioos web back end, file /bin/ioos, function sub416760.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
CVE-2026-120276 is a critical OS command injection vulnerability in the WAVLINK WN536AX6-A router's web management interface, enabling remote attackers to execute arbitrary shell commands as the ioos process. With no patch available and a public proof-of-concept reference, this flaw puts organizations using this device at risk of full network compromise, potentially disrupting business operations and exposing sensitive data. Leadership should prioritize immediate mitigation because affected routers may be deployed in branch offices or remote work setups, eroding trust in network security.
Restrict access to the web management interface to trusted networks or IP addresses, disable remote management if not required, segment affected devices from critical assets, and monitor for anomalous command execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Wn536Ax6 A
View allRemote, unauthenticated stack-based buffer overflow in the OpenVPN handler of the WAVLINK WN536AX6-A router (firmware V2
OS command injection in the WAVLINK WN536AX6-A router running firmware V260507 allows remote attackers to run arbitrary
OS command injection in WAVLINK WN536AX6-A firmware V260507 allows remote unauthenticated attackers to execute arbitrary
OS command injection in the WireGuard CLI group handler of the WAVLINK WN536AX6-A router (firmware V260507_2.0.0) lets a
OS command injection in the WAVLINK WN536AX6-A Wi-Fi router (firmware V260507) allows an attacker who can reach the devi
Exploit-DB