{"id":"CVE-2026-120279","published":"2026-11-02T01:17:26.677","lastModified":"2026-11-02T01:17:26.677","description":"A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_file_id.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120279","tags":[]},{"url":"https://vuldb.com/submit/919788","tags":[]},{"url":"https://vuldb.com/vuln/429623","tags":[]},{"url":"https://vuldb.com/vuln/429623/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_file_id.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A remote OS command injection flaw exists in the openvpn_cli handler of WAVLINK WN536AX6-A firmware V260507, triggered via manipulation of the file_id argument in /protocol.csp, allowing unauthenticated attackers to execute arbitrary commands on the device.","exploitability":"Trivial to exploit remotely with no authentication or user interaction required, as the vulnerability is accessible over the network and the exploit has been publicly published.","blast_radius":"Complete compromise of the device including full read/write/execute access, potential pivot to internal networks, and loss of confidentiality, integrity, and availability due to the CVSS 10.0 severity and C:H/I:H/A:H impact.","remediation":"Upgrade to firmware version V260508 or later, as this is the fixed version released by WAVLINK in response to this disclosure.","detection":"Look for HTTP POST requests to /protocol.csp containing suspicious file_id values with shell metacharacters (e.g., ';', '|', '$(', '`') or known command patterns (e.g., 'wget', 'curl', 'sh -c') in web server or application logs.","tags":["rce","command-injection","web","firmware","iot"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:45:46.465Z"}}