On this page (6 sections)
CVE-2026-120279 is a critical OS command injection flaw in the WAVLINK WN536AX6-A, version V260507. According to the NVD record, it can be triggered remotely, and the exploit has been published and may be used.
If you run this router at an office, a shop, a branch site or a home office that hosts anything reachable from the internet, you should check your exposure now. The NVD entry does not mention a patch, so the practical focus is limiting who can reach the device.
What was reported
The NVD description says the flaw sits in an unknown function of the file /protocol.csp, in the openvpn_cli Handler component. Manipulating the argument file_id can lead to OS command injection. The attack can be launched remotely, and the vendor was contacted early about the disclosure.
The record's references include a GitHub page and several VulDB entries, such as the VulDB entry. The research notes that only one independent publisher covers this story so far, and the details here come from the NVD record, so treat them as a single-source report. The research does not say whether the vendor has responded or released a fix.
Why command injection on a router is serious
OS command injection happens when a device takes a value from a request, here the file_id parameter, and passes it into a system command without properly restricting what it can contain. An attacker who controls that value can make the device run commands of their choosing, often with the high privileges that router services run under.
On a router, that position is powerful. The device sits between your internal network and the internet, so a compromised one can expose traffic, change DNS settings, open access to internal systems or be used as a foothold for further attacks. The research does not say whether authentication is required to reach the vulnerable function, so assume the worst until you confirm otherwise.
Who is realistically exposed
- Anyone using a WAVLINK WN536AX6-A on firmware V260507. Other versions are not covered by the research, so check them rather than assuming they are safe.
- Devices whose web management interface is reachable from the internet, through remote administration, port forwarding or UPnP.
- Networks where untrusted users or devices can reach the router's admin interface from the LAN or guest Wi-Fi.
- Small businesses and agencies that manage client sites behind this router and rely on it as their only perimeter.
The NVD text says the attack can be launched remotely, which does not by itself tell us whether it works from the open internet or only from inside the network. Plan for both.
How to check your exposure
- Log in to the router's admin page and note the model and firmware version. Compare it against WN536AX6-A V260507.
- Look for a remote management or remote administration setting and see whether it is enabled.
- Review port forwarding and UPnP mappings for anything pointing at the router's own web interface.
- From a network outside your own (for example a mobile connection), check whether the router's admin page loads at your public IP address. If it does, it is exposed.
What to do now
The research does not name a fixed firmware version, so the steps below are mitigations. Check the vendor's support pages for firmware updates and install one if it addresses this CVE.
0 of 7 done
Signs of compromise and ongoing monitoring
The research gives no indicators of compromise, so rely on general signs of a tampered router:
- Unexpected changes to DNS servers, port forwards, user accounts or VPN settings.
- Requests to /protocol.csp with unusual file_id values in any logs the device or an upstream proxy keeps.
- Unfamiliar outbound connections from the router, or admin sessions from addresses you do not recognize.
- Sudden reboots, slowdowns or settings that revert on their own.
If you suspect compromise, follow our guide on what to do when a website is hacked, and consider rotating credentials that crossed the network. For sites hosted behind the router, Webforta Monitor can alert you to uptime, certificate and DNS changes, which can surface some side effects of a tampered network device. It does not detect or fix this router flaw.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.