Vulnerability · Published Nov 1, 2026 · Assigned by VulDB

CVE-2026-120277WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection

Critical 10.0

In plain English

A critical-severity OS command injection in WN536AX6-A from WAVLINK. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 84% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)2.5%top 15.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.

Affected products (as reported)

Vendor	Product	Versions
WAVLINK	WN536AX6-A	V260507_2.0.0

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

References

VDB-429621 | WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection vdb-entry, technical-description
VDB-429621 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-120277 | CVE Analysis and Report third-party-advisory
Submit #919503 | Wavlink Router Firmware V260507_2.0.0 OS Command Injection third-party-advisory
https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_wireguard_cli_group_command_injection.md exploit