CVE-2026-120277: Command Injection in WAVLINK WN536AX6-A Router

CVE-2026-120277 is a critical remote command injection vulnerability in the WAVLINK WN536AX6-A router, version V260507_2.0.0. The flaw is located in /bin/ioos, within the WireGuard CLI Group Handler component. A remote unauthenticated attacker can manipulate the group_name argument to execute arbitrary operating system commands on the device. This affects home and small office routers in corporate and residential networks.

Severity is confirmed: CVSS 10.0, critical level. The situation is urgent because the exploit has been publicly disclosed and vendor WAVLINK was contacted early, yet as of November 2, 2026, no patch is available. Social signals confirm awareness: posts on X document the complete absence of technical fixes.

For defenders: identify and inventory all WAVLINK WN536AX6-A routers version V260507_2.0.0 on your networks (urgent). Isolate unpatched devices from the internet using perimeter firewall rules. Monitor WireGuard traffic for anomalies and suspicious behavior. Review /bin/ioos logs for command execution attempts. Contact WAVLINK directly to request corrected firmware versions and patching timeline.