CVE-2026-120280

Name of the Vulnerable Software and Affected Versions WAVLINK WN536AX6-A version V260507

Description A remote OS command injection exists in the WireGuard component. The issue occurs within the wireguard cli group handler of the /protocol.csp file. An attacker can exploit this by manipulating the group id or group name variables, which are passed unsanitized to a shell command via the system() function. Successful exploitation allows the execution of operating system commands with router-service privileges. Access to the management endpoint and a session token are required for exploitation.

Recommendations Block management access from the internet and untrusted LAN or Wi-Fi segments using network-level controls. Restrict administration access to trusted hosts only. Disconnect or replace the equipment if reliable isolation is unavailable. At the moment, there is no information about a newer version that contains a fix for this vulnerability.