CVE-2026-120276

Summary

The WAVLINK WN536AX6-A V260507_2.0.0 device's web management interface contains an OS command injection flaw in the `sub_416760` function, where unsanitized user input passed via the `group_name` parameter allows unauthenticated remote attackers to execute arbitrary OS commands on the underlying system.

Exploitability

Exploitation is trivial for remote attackers with network access to the web interface; no authentication or user interaction is required.

Blast radius

Successful exploitation grants full system compromise (confidentiality, integrity, and availability) of the device, potentially enabling lateral movement within the local network or abuse as a pivot point.

Detection

Look for HTTP POST requests to `/cgi-bin/luci/` or similar web management endpoints containing suspicious shell metacharacters (e.g., `;`, `|`, `&`, `$()`) in the `group_name` parameter, especially followed by common command strings like `id`, `whoami`, or `uname -a`. Also monitor `/var/log/messages` or `/var/log/auth.log` for unexpected process spawns from `/bin/ioos`.

Prioritized remediation

Upgrade to firmware version V260507_2.0.1 or later, as the vendor has released a patch; until then, disable the web management interface or restrict access to trusted IP ranges only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.