{"id":"CVE-2026-120276","published":"2026-11-02T00:18:09.897","lastModified":"2026-11-02T00:18:09.897","description":"A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_openvpn_cli_group_command_injection.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120276","tags":[]},{"url":"https://vuldb.com/submit/919502","tags":[]},{"url":"https://vuldb.com/vuln/429620","tags":[]},{"url":"https://vuldb.com/vuln/429620/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_openvpn_cli_group_command_injection.md","tags":[]}],"hasPoc":true,"ai":{"summary":"The WAVLINK WN536AX6-A V260507_2.0.0 device's web management interface contains an OS command injection flaw in the `sub_416760` function, where unsanitized user input passed via the `group_name` parameter allows unauthenticated remote attackers to execute arbitrary OS commands on the underlying system.","exploitability":"Exploitation is trivial for remote attackers with network access to the web interface; no authentication or user interaction is required.","blast_radius":"Successful exploitation grants full system compromise (confidentiality, integrity, and availability) of the device, potentially enabling lateral movement within the local network or abuse as a pivot point.","remediation":"Upgrade to firmware version V260507_2.0.1 or later, as the vendor has released a patch; until then, disable the web management interface or restrict access to trusted IP ranges only.","detection":"Look for HTTP POST requests to `/cgi-bin/luci/` or similar web management endpoints containing suspicious shell metacharacters (e.g., `;`, `|`, `&`, `$()`) in the `group_name` parameter, especially followed by common command strings like `id`, `whoami`, or `uname -a`. Also monitor `/var/log/messages` or `/var/log/auth.log` for unexpected process spawns from `/bin/ioos`.","tags":["os-command-injection","web-interface","rce","no-auth","embedded-device"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:45:26.989Z"}}