Wn536Ax6 A
Monthly
OS command injection in the WAVLINK WN536AX6-A Wi-Fi router (firmware V260507) allows an attacker who can reach the device's web management interface to execute arbitrary operating-system commands through the mac argument handled by the host_black function of /protocol.csp. The CVSS v4.0 vector reports PR:L, so exploitation requires a low-privileged authenticated management session (or reachable credentialed/default-login state) rather than being unauthenticated against a default configuration, and it additionally requires network reachability to the router's web UI, which on properly segmented networks is LAN-side only. A public PoC reference has been published on GitHub; it is not verified as working exploit code, there is no CISA KEV entry, and the vendor was contacted prior to disclosure. Priority guidance places remediation in the current week.
Remote, unauthenticated stack-based buffer overflow in the OpenVPN handler of the WAVLINK WN536AX6-A router (firmware V260507) lets an attacker who can reach the /protocol.csp endpoint corrupt stack memory by supplying an overlong openvpn_ip value to an unsafe strcpy, with high confidentiality, integrity and availability impact. Only this model and firmware build are identified in the affected CPE, and a public PoC reference exists at github.com/F-yyjy/cve (WN536AX6-A_openvpn_ip.md) but is not verified as working exploit code; no KEV listing is reported. Real-world exposure hinges on reachability - the available sources do not confirm whether OpenVPN must be enabled or whether the management web interface is exposed to the WAN, so LAN-only deployments are materially less exposed, and the current triage label is act_now.
OS command injection in the WAVLINK WN536AX6-A router running firmware V260507 allows remote attackers to run arbitrary shell commands on the device through the WireGuard group configuration handler, with no authentication or user interaction required per the assessed vector (PR:N/UI:N) and a CVSS 4.0 base score of 9.3 reflecting high confidentiality, integrity and availability impact on both the vulnerable system and downstream dependent systems. Exploitation is gated by reachability rather than by credentials: the web management service that exposes /protocol.csp is typically LAN-facing by default, so Internet-side attacks depend on remote administration being enabled or the router being directly exposed. A public proof-of-concept reference targets the group_id and group_name parameters; it is not verified as working exploit code, and no confirmed active exploitation is recorded. vuln.today prioritisation labels this act_now.
OS command injection in WAVLINK WN536AX6-A firmware V260507 allows remote unauthenticated attackers to execute arbitrary operating-system commands through the /protocol.csp endpoint's openvpn_cli handler by manipulating the file_id argument. Exploitation requires network reachability to the device's web management service; on consumer routers that interface is typically LAN-bound, so internet-wide attacks depend on WAN-side remote management being enabled or an existing LAN foothold. A public PoC reference exists but is not verified as working exploit code, no CISA KEV entry is supplied, and the assigned priority is act_now.
OS command injection in the WireGuard CLI group handler of the WAVLINK WN536AX6-A router (firmware V260507_2.0.0) lets an attacker who can reach the group-management interface inject arbitrary shell commands through the group_name argument processed by sub_41a1d8 in /bin/ioos, achieving full compromise of confidentiality, integrity and availability. The CVSS 4.0 score is 9.3 with a vector of AV:N/AC:L/AT:N/PR:N/UI:N, but authentication requirements are not confirmed from the available data, and if an admin session or LAN-only management access is actually needed that becomes the primary limiting factor; risk is highest where the management or WireGuard interface is exposed to the WAN. A public PoC reference exists (a GitHub write-up describing the wireguard_cli_group command injection); it is not verified as working exploit code, and there is no KEV listing or other confirmation of active exploitation.
OS command injection in the WAVLINK WN536AX6-A web management interface allows remote attackers to execute arbitrary shell commands as the device's ioos process by supplying a crafted group_name value to the OpenVPN CLI configuration handler (sub_416760 in /bin/ioos). Firmware V260507_2.0.0 is the version identified as affected in the disclosure, and the CVSS 4.0 score of 9.3 with a PR:N vector treats the endpoint as reachable without authentication, although the available sources do not confirm whether a prior login to the management UI is enforced before the vulnerable handler can be reached. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is associated with this CVE, and the vuln.today decision label for the issue is act_now based on the convergence of the command-injection impact, the public write-up, and the absence of a shipped fix.
OS command injection in the WAVLINK WN536AX6-A Wi-Fi router (firmware V260507) allows an attacker who can reach the device's web management interface to execute arbitrary operating-system commands through the mac argument handled by the host_black function of /protocol.csp. The CVSS v4.0 vector reports PR:L, so exploitation requires a low-privileged authenticated management session (or reachable credentialed/default-login state) rather than being unauthenticated against a default configuration, and it additionally requires network reachability to the router's web UI, which on properly segmented networks is LAN-side only. A public PoC reference has been published on GitHub; it is not verified as working exploit code, there is no CISA KEV entry, and the vendor was contacted prior to disclosure. Priority guidance places remediation in the current week.
Remote, unauthenticated stack-based buffer overflow in the OpenVPN handler of the WAVLINK WN536AX6-A router (firmware V260507) lets an attacker who can reach the /protocol.csp endpoint corrupt stack memory by supplying an overlong openvpn_ip value to an unsafe strcpy, with high confidentiality, integrity and availability impact. Only this model and firmware build are identified in the affected CPE, and a public PoC reference exists at github.com/F-yyjy/cve (WN536AX6-A_openvpn_ip.md) but is not verified as working exploit code; no KEV listing is reported. Real-world exposure hinges on reachability - the available sources do not confirm whether OpenVPN must be enabled or whether the management web interface is exposed to the WAN, so LAN-only deployments are materially less exposed, and the current triage label is act_now.
OS command injection in the WAVLINK WN536AX6-A router running firmware V260507 allows remote attackers to run arbitrary shell commands on the device through the WireGuard group configuration handler, with no authentication or user interaction required per the assessed vector (PR:N/UI:N) and a CVSS 4.0 base score of 9.3 reflecting high confidentiality, integrity and availability impact on both the vulnerable system and downstream dependent systems. Exploitation is gated by reachability rather than by credentials: the web management service that exposes /protocol.csp is typically LAN-facing by default, so Internet-side attacks depend on remote administration being enabled or the router being directly exposed. A public proof-of-concept reference targets the group_id and group_name parameters; it is not verified as working exploit code, and no confirmed active exploitation is recorded. vuln.today prioritisation labels this act_now.
OS command injection in WAVLINK WN536AX6-A firmware V260507 allows remote unauthenticated attackers to execute arbitrary operating-system commands through the /protocol.csp endpoint's openvpn_cli handler by manipulating the file_id argument. Exploitation requires network reachability to the device's web management service; on consumer routers that interface is typically LAN-bound, so internet-wide attacks depend on WAN-side remote management being enabled or an existing LAN foothold. A public PoC reference exists but is not verified as working exploit code, no CISA KEV entry is supplied, and the assigned priority is act_now.
OS command injection in the WireGuard CLI group handler of the WAVLINK WN536AX6-A router (firmware V260507_2.0.0) lets an attacker who can reach the group-management interface inject arbitrary shell commands through the group_name argument processed by sub_41a1d8 in /bin/ioos, achieving full compromise of confidentiality, integrity and availability. The CVSS 4.0 score is 9.3 with a vector of AV:N/AC:L/AT:N/PR:N/UI:N, but authentication requirements are not confirmed from the available data, and if an admin session or LAN-only management access is actually needed that becomes the primary limiting factor; risk is highest where the management or WireGuard interface is exposed to the WAN. A public PoC reference exists (a GitHub write-up describing the wireguard_cli_group command injection); it is not verified as working exploit code, and there is no KEV listing or other confirmation of active exploitation.
OS command injection in the WAVLINK WN536AX6-A web management interface allows remote attackers to execute arbitrary shell commands as the device's ioos process by supplying a crafted group_name value to the OpenVPN CLI configuration handler (sub_416760 in /bin/ioos). Firmware V260507_2.0.0 is the version identified as affected in the disclosure, and the CVSS 4.0 score of 9.3 with a PR:N vector treats the endpoint as reachable without authentication, although the available sources do not confirm whether a prior login to the management UI is enforced before the vulnerable handler can be reached. A public PoC reference exists; it is not verified as working exploit code, no CISA KEV entry is associated with this CVE, and the vuln.today decision label for the issue is act_now based on the convergence of the command-injection impact, the public write-up, and the absence of a shipped fix.