CVE-2026-120276

Name of the Vulnerable Software and Affected Versions WAVLINK WN536AX6-A version V260507 2.0.0

Description The Web Management Interface contains a flaw in the /bin/ioos file within the sub 416760() function. A remote attacker can execute arbitrary operating system commands by manipulating the group name argument. This is an OS command injection, which occurs when an application passes unsafe user-supplied data to a system shell.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the Web Management Interface to minimize the risk of exploitation.