On this page (7 sections)

A critical vulnerability, CVE-2026-120280, has been recorded for the WAVLINK WN536AX6-A, version V260507. According to the NVD entry, a flaw in the WireGuard component allows OS command injection, and the attack may be started remotely.

If you run this router at an office, a client site or a small hosting setup, or you expose its admin interface to the internet, you should read on. The record says an exploit has been disclosed publicly, and it does not mention a fixed firmware version.

What was reported

The NVD description says the problem sits in the handler function wireguard_cli_group in the file /protocol.csp, part of the WireGuard component. Manipulating the group_id or group_name argument leads to OS command injection. It also states that the attack may be initiated remotely, that the exploit has been disclosed to the public and may be used, and that the vendor was contacted early about the disclosure.

The record was published on 2026-11-02. Its references point to a public write-up on GitHub and to VulDB entries. Only one independent publisher covers this story so far, so details may change as the vendor or other researchers respond.

What command injection means here

OS command injection happens when a device builds a system command from text a user supplies and does not clean that text first. An attacker who controls the text can add their own instructions, and the device runs them with the privileges of the web service. On consumer and small-office routers that service usually runs with very high privileges, so a successful attack can mean full control of the device.

Control of a router matters for website owners because it sits in front of everything behind it. Traffic can be redirected, DNS settings changed, credentials captured, and the device used as a foothold into the local network or as a node in attacks on others. This is general background on the weakness class, not a description of what has been observed with this specific CVE.

Who is realistically exposed

  • Owners of the WAVLINK WN536AX6-A on firmware V260507. Other versions are not covered by the record, so their status is unknown rather than safe.
  • Anyone with the router's web management interface reachable from the internet, since the record says the attack may be initiated remotely.
  • Anyone using the router's WireGuard feature, as the flaw is in that component. The record does not say whether the feature must be enabled for the flaw to be reachable, so do not assume it is safe to leave it off.
  • Small offices, home offices and remote sites where a router doubles as the only network perimeter.
The record does not say whether authentication is required to reach the vulnerable handler. Treat the device as exposed until the vendor clarifies.

How to check your exposure

  1. Identify the model and firmware. Look at the label on the device and the status or about page of the admin interface for the model name and firmware version, and compare it with WN536AX6-A V260507.
  2. Check whether the admin interface is reachable from outside. From a network that is not your own (for example a phone on mobile data), try to open the router's public IP address in a browser. If the login page loads, remote management is exposed.
  3. Review the router's remote management, port forwarding and WireGuard settings in the admin interface and note anything open to the internet that you do not need.
  4. Look for signs of tampering: unexpected admin accounts, changed DNS servers, unknown port forwards or WireGuard peers, and unexplained reboots or configuration changes.
Tip. If you manage a website behind this router, the free SSL certificate checker and security headers checker show what the outside world sees of your site. They cannot tell you whether the router itself is compromised.

What to do now

The available record names no patched firmware, so the practical goal is to reduce exposure while you wait for the vendor. Check the vendor's support page for new firmware for this model, and apply it once a release addresses this CVE.

Caution. Changing remote management or WireGuard settings can cut off remote workers or site-to-site links that depend on them. Make changes when you have local access to the device.

If you suspect the router was already compromised, follow our guide on what to do when a website is hacked and treat any credentials that passed through the network as exposed.

Detection and monitoring afterwards

Because a router compromise can quietly change how your sites are reached, watch for the downstream effects. Unexpected DNS changes, certificate changes or downtime on your public sites can be early signs of trouble. Webforta Monitor tracks uptime, certificate, DNS and header changes for sites you add, which helps you notice that kind of drift. It does not inspect or protect the router itself.

Also review the router's own logs, if it keeps any, for repeated requests to /protocol.csp from unfamiliar addresses. The record does not describe attack traffic, so treat this as a general hunting idea rather than a confirmed indicator.

Further reading

If you manage several network devices for a small business, check each model and firmware version separately rather than assuming one record covers them all. Our small business website security guide covers wider hardening habits, and the Webforta blog tracks new advisories.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

  1. CVE-2026-120280: A vulnerability has been found in WAVLINK WN536AX6-A V260507.nvd.nist.gov ·
  • WAVLINK
  • CVE-2026-120280
  • command injection
  • router security
  • WireGuard