Is CVE-2026-120282 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120282 being exploited in the wild.

How severe is CVE-2026-120282?

Critical severity, with a CVSS score of 9.9, published 2 November 2026.

Is there a fix for CVE-2026-120282?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-120282 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-120282?

Check whether you run Wavlink WN536AX6-A at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120282: WAVLINK WN536AX6-A command injection in host_black handler

CVE-2026-120282 · Severity: critical · CVSS 9.9 · Published 2026-11-02

The WAVLINK WN536AX6-A router contains a command injection vulnerability in its web interface that allows remote code execution with root privileges. An attacker can exploit this by bypassing the device's default passwordless authentication and injecting shell commands through the MAC address parameter. This leads to complete compromise of the router and access to the network it protects.

Technologies: Wavlink WN536AX6-A. Vendors: Wavlink.

Quick answers

Is CVE-2026-120282 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120282 being exploited in the wild.
How severe is CVE-2026-120282?: Critical severity, with a CVSS score of 9.9, published 2 November 2026.
Which products and versions are affected?: Wavlink WN536AX6-A V260507.
Is there a fix for CVE-2026-120282?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-120282 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-120282?: Check whether you run Wavlink WN536AX6-A at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The /protocol.csp endpoint's host_black handler fails to sanitize the mac parameter before concatenating it into a shell command (setup_bannet_list.sh) and executing it via system(). The vulnerability requires authentication, but the device ships with FirstLogin=1 (passwordless login) enabled by default, allowing trivial bypass. An attacker needs only to obtain a session token via an unauthenticated login request, then inject a crafted payload like mac=aa" | # to execute arbitrary commands as root.

Affected products

WAVLINK WN536AX6-A V260507

Timeline

2026-11-02: disclosed
2026-11-02: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.