CVE-2026-120280: Critical command injection in WAVLINK router

CVE-2026-120280 is a critical command injection flaw identified in WAVLINK WN536AX6-A router version V260507. The vulnerability resides in the wireguard_cli_group function of the WireGuard component in file /protocol.csp. Attackers can manipulate group_id and group_name parameters to inject and execute remote system commands, gaining full device control. The attack requires no authentication and can be conducted remotely, exposing networks to immediate compromise.

The flaw presents CVSS 10.0, the maximum score, confirming critical impact. The exploit was publicly disclosed on 2026-11-02 and is already usable. According to official NVD data, WAVLINK vendor was contacted early; however, no patches have been communicated. Social signals in recent days register 3 mentions with growing attention, indicating the threat is already under discussion among researchers and sysadmins.

Priority is immediate isolation: disable or remove from network all WAVLINK WN536AX6-A v260507 devices until official patches become available. Verify presence of this model in your environments through network scans. Monitor logs for exploitation attempts targeting wireguard_cli_group function, paying particular attention to parameterized requests on /protocol.csp. Contact WAVLINK directly for status and patch timeline. Do not delay: exploit code is public.