CVE-2026-120282

Summary

A command injection flaw in the WAVLINK WN536AX6-A V260507 firmware allows authenticated remote attackers to inject OS commands via the 'mac' parameter in the /protocol.csp endpoint, enabling full system compromise.

Exploitability

Exploitation requires valid low-privilege credentials and network access to the web interface; public exploits exist, making it trivial for attackers.

Blast radius

Successful exploitation grants remote code execution with root-level privileges, allowing complete device takeover, data exfiltration, lateral movement, and persistent backdoor deployment.

Detection

Look for HTTP POST requests to /protocol.csp containing the 'mac' parameter with shell metacharacters (e.g., ';', '|', '$(', '`') or suspicious command sequences in web server access logs; also monitor for unexpected outbound connections from the device to external IPs. No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version V260508 or later, as confirmed by vendor patching of this specific vulnerability in that release.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.