External risk intelligence

WAVLINK WN536AX6-A Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-120276

The vulnerability exists in the Web Management Interface of a network router. Such interfaces are commonly exposed for remote management purposes or are accessible over the local network which, in many residential and small office router deployments, are frequently reachable or inadvertently exposed to the public internet.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been found in a WAVLINK router's web management interface that could allow remote attackers to execute operating system commands. The exploit is publicly available and could be used for malicious purposes.

Remote attackers can run commands on the router.
This could impact network device integrity.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can remotely target the WAVLINK router's web interface by sending a specially crafted request to the `/bin/ioos` endpoint. This request manipulates the `group_name` argument, triggering an operating system command injection vulnerability within the `sub_416760` function. Successful exploitation allows an attacker to execute arbitrary commands on the device.

Accessible over the network without authentication.
Manipulating a specific argument in a web request.
Arbitrary command execution on the router.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary operating system commands by manipulating the `group_name` argument in the Web Management Interface. This could impact the router's functionality and potentially any services or data it manages or protects when the interface is accessible.

Router command execution.
Remote command injection via web interface.
Compromise of router functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Web Management Interface of the WAVLINK WN536AX6-A device is susceptible to OS command injection. Given this is a network router with a web interface, infrastructure or network teams are likely responsible for its management and security. The first practical step is to identify all instances of this device within your environment, determine their reachability from external networks, and assess their business criticality to prioritize remediation efforts.

Network/Infrastructure teams should own the issue.
Verify external reachability and business criticality.
Plan phased remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WAVLINK WN536AX6-A?

The WAVLINK WN536AX6-A is a network router. Its web management interface is a portal used by administrators to configure device settings, manage network connections, and perform maintenance tasks directly through a browser.

What does command injection mean for CVE-2026-120276?

This vulnerability, classified as CWE-77 and CWE-78, occurs when the router fails to properly filter input. By sending a specially crafted request, an attacker can trick the system into running unauthorized operating system commands, effectively letting them control the device.

How is this command injection triggered?

An attacker initiates the vulnerability by targeting the /bin/ioos file through the web interface. Specifically, they manipulate the group_name argument within the sub_416760 function. Note that standard, benign use of the router's interface settings does not trigger this flaw.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies that this router's management interface is often reachable over local networks. If your interface is configured for remote management or is inadvertently exposed to the internet, the device is considered externally accessible and at higher risk.

What should I do if I use this router?

Begin by inventorying all instances of the WN536AX6-A in your network. Prioritize checking if the management interface is accessible from the internet. If you identify exposed units, limit their network reachability immediately while evaluating further security measures.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.