CVE-2026-120279

Summary

A remote OS command injection flaw exists in the openvpn_cli handler of WAVLINK WN536AX6-A firmware V260507, triggered via manipulation of the file_id argument in /protocol.csp, allowing unauthenticated attackers to execute arbitrary commands on the device.

Exploitability

Trivial to exploit remotely with no authentication or user interaction required, as the vulnerability is accessible over the network and the exploit has been publicly published.

Blast radius

Complete compromise of the device including full read/write/execute access, potential pivot to internal networks, and loss of confidentiality, integrity, and availability due to the CVSS 10.0 severity and C:H/I:H/A:H impact.

Detection

Look for HTTP POST requests to /protocol.csp containing suspicious file_id values with shell metacharacters (e.g., ';', '|', '$(', '`') or known command patterns (e.g., 'wget', 'curl', 'sh -c') in web server or application logs.

Prioritized remediation

Upgrade to firmware version V260508 or later, as this is the fixed version released by WAVLINK in response to this disclosure.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.