CVE-2026-120279: Command Injection in WAVLINK WN536AX6-A

CVE-2026-120279 identifies an OS command injection vulnerability in the WAVLINK WN536AX6-A router (version V260507 confirmed). The flaw resides in the openvpn_cli Handler component, in the /protocol.csp file, where the file_id parameter is not properly sanitized. A remote attacker can manipulate this parameter to inject operating system commands and obtain full control of the device. The vector is remote, without authentication prerequisites.

The vulnerability received a CVSS 10.0 score (maximum), critical classification. This means maximum impact on confidentiality, integrity, and availability of affected systems. The most critical status: the exploit has already been published (2026-11-02) and the community is actively reporting it on X (1 signal in the last 24 hours, in coherent line with NVD technical description). The WAVLINK vendor was contacted before public disclosure, as stated.

For defenders: 1) Immediately inventory all WAVLINK WN536AX6-A devices in your network, prioritizing those exposed to the internet. 2) Check WAVLINK vendor advisories for official patches. 3) Apply the patch as soon as available, or isolate the device from the network as a temporary measure. 4) Implement firewall rules blocking unauthorized access to the /protocol.csp endpoint. 5) Enable advanced monitoring of logs and suspicious traffic to this path. Priority action for sysadmins and CISOs.