WAVLINK WN536AX6-A EUVD-2026-114907

Exploitation requires the attacker to reach the WireGuard CLI group handler (the sub_41a1d8 function in /bin/ioos) and supply a malicious group_name argument on a WAVLINK WN536AX6-A running V260507_2.0.0; the injection point is the WireGuard group-management feature specifically. The CVSS vector rates this as remote and unauthenticated (AV:N/PR:N/UI:N), but the description does not explicitly confirm that the endpoint is accessible without an authenticated admin session - if authentication or LAN-only access to the router management interface is in fact required, that is the primary limiting factor. Realistic risk is highest where the device's management/WireGuard interface is exposed to the WAN; it is substantially constrained on devices reachable only from a trusted LAN.

This is a genuine high-priority issue for exposed devices, but several key signals are missing and should temper absolute certainty. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, no-authentication, no-user-interaction OS command injection with high confidentiality, integrity and availability impact, and the vuln.today decision label is act_now. Working against raw severity: the only exploitation-maturity signal present is E:P (Proof-of-Concept), and the input states the PoC is a reference only, not verified as working exploit code, so active exploitation is NOT established. There is no CISA KEV listing and no EPSS score in the provided data, so widespread or targeted active exploitation cannot be confirmed or ruled out from these sources. The PR:N (unauthenticated) rating comes from VulDB's assessment, not from the description, which does not state whether the WireGuard CLI group handler is reachable before authentication - this is the single most important unverified assumption, because if the endpoint actually requires an authenticated admin session the real-world risk drops substantially. Net: treat as a serious, prioritize-now vulnerability for any affected WAVLINK WN536AX6-A unit, especially if the management interface is internet-facing, but verify the authentication precondition and confirm a fixed firmware with the vendor before assuming trivial mass exploitation.

An attacker who can reach the router's WireGuard CLI group management functionality sends a crafted group_name value containing shell metacharacters, which the sub_41a1d8 function in /bin/ioos passes unsanitized into an OS command, executing attacker-chosen commands on the router (typically as root). A public PoC reference exists but is not verified as working exploit code, so a working exploit may require additional development or reproduction of the disclosed technique.