On this page (7 sections)
A critical vulnerability, CVE-2026-120276, has been published for the WAVLINK WN536AX6-A router, firmware version V260507_2.0.0. According to the GitHub Advisory Database entry, the flaw is an OS command injection in the device's web management interface, it can be triggered remotely, and a public exploit is available.
If you own, resell or administer this router, or manage a network where one sits at the edge, you should read on. The advisory lists no patched version, so the practical focus today is reducing exposure.
What was disclosed
The advisory text says the problem sits in the function sub_416760 of the file /bin/ioos, part of the Web Management Interface. Manipulating the argument group_name leads to OS command injection. The same text states the attack can be started remotely and that the exploit has been made public and could be used for attacks. It also says the vendor was contacted early about the disclosure.
The advisory links to a write-up in a public GitHub repository and to VulDB entries. We have not reproduced any exploit details here, and you do not need them to defend your device.
- CVSS v4 base score
- 9.3
- Attack vector
- Network
- Privileges and user interaction required
- None
- Impact on confidentiality, integrity and availability
- High
What command injection means for a router
Command injection happens when a device takes a value from a request, here a field called group_name, and passes it into a system command without properly limiting what it can contain. An attacker who controls that value can make the device run commands the manufacturer never intended.
The CVSS v4 metrics in the advisory show a network attack vector, low attack complexity, no attack requirements, no privileges, no user interaction, and high impact on confidentiality, integrity and availability, including for subsequent systems beyond the router itself. In practical terms, command execution on a router could let someone change settings, intercept or redirect traffic, or use the device as a foothold in the network. The research does not describe specific attacks seen in the wild, so treat those as possible consequences of this class of bug, not confirmed events.
Who is realistically exposed
- Home and small office users with a WN536AX6-A on firmware V260507_2.0.0.
- Anyone who has enabled remote administration, or forwarded the router's management port, so the web interface answers from the internet.
- Networks where an attacker, or an already compromised device, can reach the admin interface from the inside, since the interface itself is the attack surface.
- Agencies and hosting administrators who ship or manage these routers for clients.
The research does not say whether other WAVLINK models or firmware versions are affected by this specific CVE. The advisory names only the WN536AX6-A on V260507_2.0.0, so check the advisory for your exact device and firmware.
How to check your exposure
- Find the model and firmware version in the router's admin page or on the device label. You are looking for WN536AX6-A with V260507_2.0.0.
- Check whether remote administration is enabled in the router settings, and whether any port forward points at the router's own management interface.
- From a device outside your network, such as a phone on mobile data, try to open the router's public IP address in a browser. If the login page loads, the interface is exposed.
- Check the WAVLINK support site for a firmware update or security notice for this model. The research lists none, so absence of a fix is itself a result worth recording.
What to do now
No patch is listed, so mitigation is about limiting who can reach the management interface and watching for signs of tampering.
0 of 8 done
Detection and monitoring
There are no published indicators of compromise in the research, so detection relies on spotting unexpected change. Look for unfamiliar admin accounts or settings, DNS servers you did not configure, new port forwards, unexplained reboots, or router behavior that changed without your involvement. If any of these appear, factory reset the device, reapply a clean configuration and rotate every password that passed through the network.
For the websites behind the router, watch for sudden DNS or certificate changes, which can indicate traffic redirection. Webforta Monitor tracks uptime, certificate, DNS and header changes, which can help you notice that kind of symptom, though it does not test or protect the router itself. If you suspect a compromise, the guide on what to do when a website is hacked covers cleanup and credential rotation.
What we still do not know
- Whether WAVLINK has acknowledged the issue or plans a firmware fix.
- Whether other models or firmware versions share the flawed code.
- Whether attackers are exploiting it in the wild. The exploit is public, which raises the likelihood, but the research does not confirm attacks.
We will treat this as a critical exposure for any internet-reachable WN536AX6-A until a vendor fix is confirmed.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.