On this page (6 sections)
CVE-2026-120282 is an OS command injection flaw in the WAVLINK WN536AX6-A, version V260507. According to the NVD record, the problem sits in the function host_black of the file /protocol.csp, and it can be triggered remotely by manipulating the mac argument. The exploit has been publicly disclosed.
If you run this router at an office, a shop or a client site, or you manage networks that include WAVLINK devices, this one deserves attention. The research available so far is limited to the NVD entry and its references, so this article separates what is confirmed from what is not.
What was disclosed
The NVD description says the vulnerability was determined in the WAVLINK WN536AX6-A V260507 and affects the host_black function in /protocol.csp. Manipulating the mac argument leads to OS command injection. It also states that remote exploitation is possible, that the exploit has been publicly disclosed and may be used, and that the vendor was contacted early about the disclosure.
The record references a public write-up on GitHub and entries on VulDB. We have not reproduced any technical exploitation detail here, and you do not need it to assess your exposure.
Two points are not established by the research. First, there is no statement from WAVLINK, so we do not know whether a patched firmware exists. Second, nothing says the flaw is being exploited in attacks. Only one independent publisher covers the story so far, so treat details as preliminary.
Why command injection on a router matters
OS command injection happens when a device takes a value supplied by a user, here a MAC address, and passes it into a system command without properly restricting what it contains. Instead of being treated as plain data, parts of the input can be interpreted as extra instructions. On an embedded device those instructions typically run with high privileges.
A MAC address field is a natural place for this bug. It looks harmless, and the name host_black suggests a block-list style feature, though the research does not describe what the function does. The practical risk of a router compromise is broad: an attacker could change settings, watch or redirect traffic, or use the device as a foothold inside your network. Those are general consequences of this weakness class, not confirmed behavior for this specific flaw.
Who is realistically exposed
- Owners of a WAVLINK WN536AX6-A running firmware V260507, the version named in the record.
- Anyone whose web management interface is reachable from the internet, through remote administration or port forwarding. The record says remote exploitation is possible.
- Small offices and agencies that deploy inexpensive routers or access points at client sites and rarely revisit their firmware.
- Networks where the device sits next to point-of-sale systems, file shares or servers, since a compromised router can be a stepping stone.
Other firmware versions of this model may or may not be affected. The research names only V260507, so check the vendor's guidance rather than assuming a different version is safe.
How to check your exposure
Start by finding out whether you have the device and which firmware it runs. Log in to the router's admin page from inside your network and look at the system or status page for the model name and firmware version. Compare it with V260507.
Next, check whether the admin interface is reachable from outside. From a machine on a different network, such as a phone on mobile data, try opening the router's public IP address in a browser. If you get a login page, the interface is exposed.
If you manage a website, you can also review what your web-facing setup exposes. Webforta Scan performs read-only security scans of websites you verify, though it is not a router firmware audit.
If you have a Linux server or reverse proxy that logs traffic towards the router, this read-only search prints log lines that mention the vulnerable path. Review any matches for unusual mac values. Adjust the log path to your setup:
grep -F "/protocol.csp" /var/log/nginx/access.logMost consumer routers do not keep detailed access logs, so absence of results proves little. Unexpected configuration changes, unfamiliar DNS settings, new port forwards or unexplained reboots are better signals on the device itself.
What to do now
There is no confirmed patch in the research, so the priority is to reduce exposure while you wait for vendor guidance.
0 of 8 done
If you suspect compromise, factory reset the device, update firmware if a fixed version exists, and set it up again by hand instead of restoring an old settings backup, which could carry over malicious changes. Our guide to what to do when a site is hacked covers the wider response.
Monitoring afterwards
- Watch the vendor's support pages and the NVD and VulDB entries for a fixed firmware version and any change in exploitation status.
- Alert on unexpected changes to your public IP's open ports and to DNS records for your domains. Webforta Monitor tracks uptime, certificate, DNS and header changes, which can surface side effects of a network compromise.
- Re-check router settings after any unexplained outage or reboot.
- Rotate credentials that were used on or through the device if you find evidence of tampering.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.