# CVE-2026-120279: WAVLINK WN536AX6 OS command injection in OpenVPN handler

Source: https://junglewise.ai/threats/cve-2026-120279-a-flaw-has-been-found-in-wavlink-wn536ax6-a-v260507-the-affected  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-120279 · Severity: critical · CVSS 10 · Published 2026-11-02

WAVLINK's WN536AX6 router contains a critical vulnerability in its web interface that allows attackers to execute arbitrary system commands with root privileges. The device ships with passwordless login enabled by default, making the vulnerability trivially exploitable without valid credentials. A successful attack grants complete control of the router, potentially compromising all devices and data on the network.

Technologies: [Wavlink WN536AX6-A](https://junglewise.ai/threats/technologies/wn536ax6-a). Vendors: [Wavlink](https://junglewise.ai/threats/vendors/wavlink).

## Quick answers

**Is CVE-2026-120279 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120279 being exploited in the wild.

**How severe is CVE-2026-120279?** Critical severity, with a CVSS score of 10, published 2 November 2026.

**Which products and versions are affected?** Wavlink WN536AX6-A V260507.

**Is there a fix for CVE-2026-120279?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120279 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-120279?** Check whether you run Wavlink WN536AX6-A at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an OS command injection in the /protocol.csp endpoint's openvpn_cli handler, where the file_id parameter is directly concatenated into a shell command without sanitization before execution via popen(). While the endpoint requires authentication, the device defaults to passwordless login (FirstLogin=1), allowing unauthenticated token acquisition; an attacker can then exploit the injection via payload like file_id=aa" | <command> # to execute arbitrary commands as root.

## Affected products

- WAVLINK WN536AX6-A V260507

## Timeline

- 2026-11-02: disclosed: Vulnerability published with proof-of-concept exploit

## References

- [https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_file_id.md](https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_file_id.md)
- [https://vuldb.com/cve/CVE-2026-120279](https://vuldb.com/cve/CVE-2026-120279)

## Related threats

- [WAVLINK WN536AX6-A command injection in host_black handler](https://junglewise.ai/threats/cve-2026-120282-a-vulnerability-was-determined-in-wavlink-wn536ax6-a-v260507)
- [WAVLINK WN536AX6-A stack buffer overflow in OpenVPN handler](https://junglewise.ai/threats/cve-2026-120281-a-vulnerability-was-found-in-wavlink-wn536ax6-a-v260507-this)
- [WAVLINK WN536AX6-A authentication bypass in VPN client handler](https://junglewise.ai/threats/cve-2026-120278-a-vulnerability-was-detected-in-wavlink-wn536ax6-a-v260507-2-0-0)
- [WAVLINK WN536AX6-A OS command injection in WireGuard CLI handler](https://junglewise.ai/threats/cve-2026-120277-a-security-vulnerability-has-been-detected-in-wavlink-wn536ax6-a)
- [WAVLINK WN536AX6-A OS command injection in web management interface](https://junglewise.ai/threats/cve-2026-120276-a-weakness-has-been-identified-in-wavlink-wn536ax6-a-v260507-2-0)