External risk intelligence

WAVLINK WN536AX6-A WireGuard Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-120280

The vulnerability affects a WAVLINK networking device, which is an internet edge gateway product. These devices are designed to be public-facing to provide connectivity and remote access services, and the identified component is part of the device's management or protocol handling exposed to the network.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been publicly disclosed in WAVLINK networking devices that could allow remote attackers to execute commands on the affected system. The issue stems from a flaw in how the device handles certain inputs related to its WireGuard functionality, potentially enabling unauthorized command execution.

Flaw allows remote attackers to run commands.
Affects internet-facing networking devices.
Confirm relevance and assess exposure to this risk.

Attack Path

How an attacker could exploit the issue

An attacker can remotely target a WAVLINK WN536AX6-A device by exploiting a vulnerability in the WireGuard component. By manipulating specific arguments within the `wireguard_cli_group` handler, an attacker can inject operating system commands, potentially leading to a full device compromise.

Requires network access to the device.
Triggered by manipulating group arguments in a handler.
Allows remote command injection and device compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary commands on the device when they manipulate specific arguments within the WireGuard handler. This could affect the device's network functions and potentially expose its configuration.

Device command execution.
Remote manipulation of arguments.
Compromised device services.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical command injection vulnerability in the WireGuard component of WAVLINK WN536AX6-A devices requires immediate attention. Network and security teams should prioritize identifying all instances of this hardware, assessing their exposure to the internet, and confirming business criticality to inform remediation strategies. Coordination with the vendor for an official fix or mitigation guidance is essential, alongside planning for a maintenance window to apply updates or implement compensating controls.

Network/security teams own the investigation.
Verify external reachability and device criticality.
Plan vendor-assisted remediation or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WAVLINK WN536AX6-A?

The WAVLINK WN536AX6-A is a wireless networking device, typically used as an internet edge gateway. It provides home or office network connectivity and manages traffic via features like WireGuard, which is designed to support secure virtual private network (VPN) tunneling protocols.

How does CVE-2026-120280 work?

This vulnerability is classified as an OS command injection flaw (CWE-77/CWE-78). It occurs because the device's WireGuard component improperly validates input provided to the 'group_id' or 'group_name' arguments within the 'wireguard_cli_group' handler. By sending specially crafted input, an attacker can trick the system into executing unauthorized operating system commands.

What triggers this command injection?

An attacker triggers the vulnerability by sending malicious input to the specific WireGuard handler function in the '/protocol.csp' file. The flaw is not triggered by standard, legitimate configuration changes; it requires an attacker to successfully manipulate these specific function arguments to inject commands. Other, non-WireGuard functions are not impacted by this specific path.

Is my device at risk?

If you are running the WAVLINK WN536AX6-A, you should consider this a high priority. According to Halo Surface Signal, this is an internet edge gateway, meaning these devices are frequently placed in public-facing roles to provide connectivity. If your device is accessible from the internet, it is at higher risk because the command injection can be initiated remotely.

How should I respond to this threat?

Start by identifying all WAVLINK WN536AX6-A units in your environment and confirming if they are exposed to the internet. Since this is a critical vulnerability, prioritize restricting access to these management interfaces if possible. Consult the vendor for official firmware updates or guidance on implementing compensating controls, and prepare a maintenance window to apply those fixes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.