CVE-2026-120280

Summary

The WAVLINK WN536AX6-A firmware's WireGuard configuration endpoint exposes an OS command injection flaw in the 'group_id' or 'group_name' parameter via the wireguard_cli_group handler, allowing unauthenticated remote attackers to execute arbitrary commands on the device.

Exploitability

Exploitation is trivial for remote attackers as no authentication, user interaction, or special conditions are required (CVSS AV:N/AC:L/PR:N/UI:N).

Blast radius

Successful exploitation grants full system compromise of the router, enabling complete data exfiltration, persistence, lateral movement, and service disruption.

Detection

Look for HTTP POST requests to /protocol.csp containing 'group_id' or 'group_name' parameters with shell metacharacters (e.g., ';', '|', '$(', '`') or long command strings in web server access logs; also monitor for unexpected child processes spawned by the web service user (e.g., 'sh', 'bash', 'wget', 'curl') in system logs.

Prioritized remediation

Upgrade to firmware version V260508 or later, as confirmed by vendor patching; until then, disable the WireGuard feature entirely or restrict access to the /protocol.csp endpoint to trusted internal networks only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.