External risk intelligence

WAVLINK WN536AX6-A Remote Command Injection via openvpn_cli Handler

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-120279

The affected product is a consumer router (WAVLINK WN536AX6-A) and the vulnerability exists within an OpenVPN handler component. VPN gateways and network edge devices are designed to be internet-facing to facilitate remote access, making their management surfaces or VPN termination endpoints inherently exposed to the public internet in standard deployment configurations.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WAVLINK networking device component that handles OpenVPN. This flaw allows for remote command injection, meaning an attacker could potentially execute commands on the device without any authentication. Given the exploit has been published, this presents a potential risk to connected systems.

Remote attackers can inject commands into the device.
Consumer routers are internet-facing, increasing exposure risk.
Confirm relevance and assess exposure to connected systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability remotely without needing any authentication by targeting a specific function within the OpenVPN CLI handler. By manipulating a parameter related to a file ID, an attacker can inject operating system commands, potentially leading to significant system compromise.

No authentication required.
Manipulating file ID argument triggers injection.
Remote command execution with high impact.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the affected device. The attack targets a specific function within the OpenVPN client handler, potentially impacting the device's network behavior and any data it processes.

Device OS command execution.
Via crafted remote request.
Compromise of device functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in WAVLINK routers, affecting the OpenVPN CLI handler, requires immediate attention from network and security teams. The first practical step is to identify all instances of the affected device, confirm their internet reachability and business criticality, and then assign an owner for remediation planning.

Network infrastructure teams should own the issue.
Verify external exposure and device criticality.
Plan immediate remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WAVLINK WN536AX6-A device?

The WAVLINK WN536AX6-A is a consumer-grade router designed to manage home or small office network traffic. It includes various networking features, such as VPN support, intended to allow secure connections for remote users and linked hardware. This device acts as a gateway, facilitating communication between internal devices and the broader internet.

How does CVE-2026-120279 allow command injection?

This vulnerability involves an OS command injection flaw, specifically categorized under CWE-77 and CWE-78. It occurs when the router's openvpn_cli handler processes input incorrectly. By manipulating the 'file_id' argument sent to the /protocol.csp file, an attacker can bypass intended restrictions and force the underlying operating system to execute unauthorized commands with the router's own privileges.

What triggers this command injection vulnerability?

An attacker triggers this flaw by sending a specifically crafted network request to the device's openvpn_cli handler. Because the vulnerable function does not properly validate the 'file_id' input, providing malicious content there activates the injection. The flaw does not require any prior authentication, but it is limited to interactions specifically targeting this input parameter within the /protocol.csp interface.

Is my device at risk based on Halo Surface Signal?

Yes, if you use a WAVLINK WN536AX6-A, it is at higher risk. Halo Surface Signal notes that this router is a network edge device, which is typically configured to be internet-facing to support remote access. Because the vulnerable OpenVPN component is part of this management surface, the device is inherently exposed to incoming requests from the public internet, making it reachable for remote exploitation attempts.

What should I do to secure my router?

Start by identifying all instances of the WAVLINK WN536AX6-A within your environment to determine which units are active. Verify whether these devices are directly accessible from the internet. Once you have located the devices, confirm their role in your network architecture and prioritize the planning of remediation steps to mitigate the potential for unauthorized command execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.