{"id":"CVE-2026-120280","published":"2026-11-02T01:17:26.873","lastModified":"2026-11-02T01:17:26.873","description":"A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_group_id.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120280","tags":[]},{"url":"https://vuldb.com/submit/919789","tags":[]},{"url":"https://vuldb.com/vuln/429624","tags":[]},{"url":"https://vuldb.com/vuln/429624/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_group_id.md","tags":[]}],"hasPoc":true,"ai":{"summary":"The WAVLINK WN536AX6-A firmware's WireGuard configuration endpoint exposes an OS command injection flaw in the 'group_id' or 'group_name' parameter via the wireguard_cli_group handler, allowing unauthenticated remote attackers to execute arbitrary commands on the device.","exploitability":"Exploitation is trivial for remote attackers as no authentication, user interaction, or special conditions are required (CVSS AV:N/AC:L/PR:N/UI:N).","blast_radius":"Successful exploitation grants full system compromise of the router, enabling complete data exfiltration, persistence, lateral movement, and service disruption.","remediation":"Upgrade to firmware version V260508 or later, as confirmed by vendor patching; until then, disable the WireGuard feature entirely or restrict access to the /protocol.csp endpoint to trusted internal networks only.","detection":"Look for HTTP POST requests to /protocol.csp containing 'group_id' or 'group_name' parameters with shell metacharacters (e.g., ';', '|', '$(', '`') or long command strings in web server access logs; also monitor for unexpected child processes spawned by the web service user (e.g., 'sh', 'bash', 'wget', 'curl') in system logs.","tags":["os-command-injection","rce","wireguard","embedded-device","no-auth","web"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:46:04.997Z"}}