WAVLINK WN536AX6-A Command Injection and Buffer Overflow

OS command injection in WAVLINK WN536AX6-A firmware V260507 allows remote unauthenticated attackers to execute arbitrary operating-system commands through the /protocol.csp endpoint's openvpn_cli handler by manipulating the file_id argument. Exploitation requires network reachability to the device's web management service; on consumer routers that interface is typically LAN-bound, so internet-wide attacks depend on WAN-side remote management being enabled or an existing LAN foothold. A public PoC reference exists but is not verified as working exploit code, no CISA KEV entry is supplied, and the assigned priority is act_now.

OS command injection in the WAVLINK WN536AX6-A router running firmware V260507 allows remote attackers to run arbitrary shell commands on the device through the WireGuard group configuration handler, with no authentication or user interaction required per the assessed vector (PR:N/UI:N) and a CVSS 4.0 base score of 9.3 reflecting high confidentiality, integrity and availability impact on both the vulnerable system and downstream dependent systems. Exploitation is gated by reachability rather than by credentials: the web management service that exposes /protocol.csp is typically LAN-facing by default, so Internet-side attacks depend on remote administration being enabled or the router being directly exposed. A public proof-of-concept reference targets the group_id and group_name parameters; it is not verified as working exploit code, and no confirmed active exploitation is recorded. vuln.today prioritisation labels this act_now.

Remote, unauthenticated stack-based buffer overflow in the OpenVPN handler of the WAVLINK WN536AX6-A router (firmware V260507) lets an attacker who can reach the /protocol.csp endpoint corrupt stack memory by supplying an overlong openvpn_ip value to an unsafe strcpy, with high confidentiality, integrity and availability impact. Only this model and firmware build are identified in the affected CPE, and a public PoC reference exists at github.com/F-yyjy/cve (WN536AX6-A_openvpn_ip.md) but is not verified as working exploit code; no KEV listing is reported. Real-world exposure hinges on reachability - the available sources do not confirm whether OpenVPN must be enabled or whether the management web interface is exposed to the WAN, so LAN-only deployments are materially less exposed, and the current triage label is act_now.

OS command injection in the WAVLINK WN536AX6-A Wi-Fi router (firmware V260507) allows an attacker who can reach the device's web management interface to execute arbitrary operating-system commands through the mac argument handled by the host_black function of /protocol.csp. The CVSS v4.0 vector reports PR:L, so exploitation requires a low-privileged authenticated management session (or reachable credentialed/default-login state) rather than being unauthenticated against a default configuration, and it additionally requires network reachability to the router's web UI, which on properly segmented networks is LAN-side only. A public PoC reference has been published on GitHub; it is not verified as working exploit code, there is no CISA KEV entry, and the vendor was contacted prior to disclosure. Priority guidance places remediation in the current week.

Missing authentication in the VPN Client List Handler of WAVLINK WN536AX6-A firmware V260507_2.0.0 lets remote attackers manipulate the 'opt' argument in /bin/ioos to disclose VPN client information without credentials. The disclosure states the exploit is now public and references a GitHub write-up, but no CISA KEV entry is indicated; the issue is confidentiality-only and moderate priority because the management service is typically LAN-facing unless remote management is enabled.