Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-120279: WAVLINK WN536AX6-A allows remote command execution
CVE-2026-120279 · published today
Summary
The WAVLINK WN536AX6-A router can be tricked into running any command on its operating system through a specially crafted request to its OpenVPN handling component. This can be done from outside the network, giving an attacker control of the device. Apply the vendor's security update or firmware patch as soon as it is available and restrict remote access to the router's management interfaces.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wavlink | wn536ax6-a | V260507 |
Original advisory text
WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection
A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
References
- https://vuldb.com/vuln/429623 vdb-entry technical-description
- https://vuldb.com/vuln/429623/cti signature permissions-required
- https://vuldb.com/cve/CVE-2026-120279 third-party-advisory
- https://vuldb.com/submit/919788 third-party-advisory
- https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_file_id... exploit
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-78OS Command Injection
CWE-77Command Injection
Timeline
Published2 Nov 2026
Updated2 Nov 2026
First seen2 Nov 2026
Track software like this
Free during beta