External risk intelligence

WAVLINK WN536AX6-A WireGuard CLI OS Command Injection.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-120277

The affected product is a consumer router (WAVLINK WN536AX6-A). This device class frequently acts as an internet edge gateway. The vulnerability involves a WireGuard CLI handler, which is a component of a remote access and networking service typically exposed or intended for use at the network perimeter.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WAVLINK router component that handles WireGuard command-line interface functions. This issue allows for remote command injection, meaning an attacker could potentially execute arbitrary commands on the affected device without any authentication. The exploit has been publicly disclosed, increasing the risk of its use.

Attackers can remotely run commands on the router.
This could impact network security and device control.
Confirm relevance and exposure to safeguard network edge.

Attack Path

How an attacker could exploit the issue

An attacker can remotely target this router by sending a specially crafted argument to the WireGuard CLI Group Handler. This manipulation exploits a weakness in the `sub_41a1d8` function within the `/bin/ioos` file, allowing the attacker to inject operating system commands. The vulnerability could lead to significant compromise if successfully triggered.

Attacker needs network access.
Triggered by manipulating a command argument.
Risk of full system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on the affected device when the WireGuard CLI handler processes a manipulated `group_name` argument. This may impact the device's core functions and potentially expose network traffic.

Affected asset: Router command execution.
Exposure: Remotely via manipulated argument.
Consequence: Device compromise and network exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The criticality of this command injection vulnerability in the WAVLINK WN536AX6-A router necessitates immediate attention from teams responsible for network edge devices and internet-facing services. The first practical step is to inventory all instances of this device, determine their exposure to the internet, and identify the business owner. Subsequently, a risk-based remediation plan should be developed, potentially involving coordination with the vendor.

Network and security teams own this.
Verify internet-facing instances.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WAVLINK WN536AX6-A device?

The WAVLINK WN536AX6-A is a consumer networking router. It provides wireless connectivity and routing capabilities for home or small office environments. The affected software component, the WireGuard CLI Group Handler, specifically facilitates the device's ability to manage WireGuard VPN tunnels, which are used to create secure, encrypted connections for network traffic.

What is OS command injection in CVE-2026-120277?

This vulnerability is classified as OS Command Injection (CWE-77/78). It means that an attacker can trick the router's software into running unauthorized system commands. By sending a malicious input to the WireGuard CLI handler, the attacker can force the device to execute code of their choosing, potentially giving them full control over the router's operating system.

How is this command injection vulnerability triggered?

An attacker triggers this bug by sending a specially crafted 'group_name' argument to the WireGuard CLI handler. The vulnerability exists in the function 'sub_41a1d8' inside the '/bin/ioos' file. This attack does not require authentication or physical access to the device; however, the attacker must have network connectivity to the router to send the malformed command argument.

Is my network at risk from this CVE?

According to Halo Surface Signal, this router class frequently functions as an internet edge gateway, making it a likely target if exposed to the public internet. Because the WireGuard component is often intended for network perimeter access, devices reachable directly from the internet face the highest risk. Internal-only devices remain safer but could still be targeted by compromised systems already inside your network.

How should I respond to this threat?

Begin by identifying all WAVLINK WN536AX6-A units within your environment. Verify whether these devices are exposed directly to the internet, as this significantly raises the risk. Once identified, restrict access to the device's management interfaces, disconnect unnecessary external-facing services, and coordinate with the vendor for official guidance or remediation steps to secure the affected command-line functions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.