{"id":"CVE-2026-120282","published":"2026-11-02T01:17:27.293","lastModified":"2026-11-02T01:17:27.293","description":"A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_mac.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120282","tags":[]},{"url":"https://vuldb.com/submit/919791","tags":[]},{"url":"https://vuldb.com/vuln/429626","tags":[]},{"url":"https://vuldb.com/vuln/429626/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_mac.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection flaw in the WAVLINK WN536AX6-A V260507 firmware allows authenticated remote attackers to inject OS commands via the 'mac' parameter in the /protocol.csp endpoint, enabling full system compromise.","exploitability":"Exploitation requires valid low-privilege credentials and network access to the web interface; public exploits exist, making it trivial for attackers.","blast_radius":"Successful exploitation grants remote code execution with root-level privileges, allowing complete device takeover, data exfiltration, lateral movement, and persistent backdoor deployment.","remediation":"Upgrade to firmware version V260508 or later, as confirmed by vendor patching of this specific vulnerability in that release.","detection":"Look for HTTP POST requests to /protocol.csp containing the 'mac' parameter with shell metacharacters (e.g., ';', '|', '$(', '`') or suspicious command sequences in web server access logs; also monitor for unexpected outbound connections from the device to external IPs. No reliable host or network indicator is derivable from the published description.","tags":["command-injection","rce","web-interface","firmware","authenticated"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:50:25.846Z"}}