CVE-2026-120276: OS command injection in WAVLINK WN536AX6-A router

CVE-2026-120276 is an OS command injection vulnerability in the WAVLINK WN536AX6-A router (version V260507_2.0.0). The flaw is located in the Web Management Interface, specifically in the /bin/ioos file at function sub_416760. The group_name parameter is not properly validated, allowing remote attackers to inject arbitrary operating system commands. This vulnerability directly impacts sysadmins and IT teams managing networks with these devices.

The CVSS score is 10.0 (maximum possible), confirming critical severity. The exploit has been made public, meaning it is already available for active attacks. The vulnerability was published on NVD on 2026-11-02. X signals show 5 posts in the last 24 hours confirming exploit availability and vulnerability details. The vendor has been contacted early, but no official patch is currently available.

For defense: immediately verify if your network hosts WAVLINK WN536AX6-A routers running version V260507_2.0.0. If present, isolate the device from the network or strictly limit Web Management Interface access via firewall and network segmentation. Monitor access logs for exploitation attempts. Contact WAVLINK vendor directly for security patch information. Consider replacing the device if it cannot be patched or isolated.