# CVE-2026-120282: WAVLINK WN536AX6-A command injection in host_black handler

Source: https://junglewise.ai/threats/cve-2026-120282-a-vulnerability-was-determined-in-wavlink-wn536ax6-a-v260507  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-120282 · Severity: critical · CVSS 9.9 · Published 2026-11-02

The WAVLINK WN536AX6-A router contains a command injection vulnerability in its web interface that allows remote code execution with root privileges. An attacker can exploit this by bypassing the device's default passwordless authentication and injecting shell commands through the MAC address parameter. This leads to complete compromise of the router and access to the network it protects.

Technologies: [Wavlink WN536AX6-A](https://junglewise.ai/threats/technologies/wn536ax6-a). Vendors: [Wavlink](https://junglewise.ai/threats/vendors/wavlink).

## Quick answers

**Is CVE-2026-120282 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120282 being exploited in the wild.

**How severe is CVE-2026-120282?** Critical severity, with a CVSS score of 9.9, published 2 November 2026.

**Which products and versions are affected?** Wavlink WN536AX6-A V260507.

**Is there a fix for CVE-2026-120282?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120282 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-120282?** Check whether you run Wavlink WN536AX6-A at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The /protocol.csp endpoint's host_black handler fails to sanitize the mac parameter before concatenating it into a shell command (setup_bannet_list.sh) and executing it via system(). The vulnerability requires authentication, but the device ships with FirstLogin=1 (passwordless login) enabled by default, allowing trivial bypass. An attacker needs only to obtain a session token via an unauthenticated login request, then inject a crafted payload like mac=aa" | # to execute arbitrary commands as root.

## Affected products

- WAVLINK WN536AX6-A V260507

## Timeline

- 2026-11-02: disclosed
- 2026-11-02: advisory

## References

- [https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_mac.md](https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_mac.md)
- [https://vuldb.com/cve/CVE-2026-120282](https://vuldb.com/cve/CVE-2026-120282)

## Related threats

- [WAVLINK WN536AX6-A stack buffer overflow in OpenVPN handler](https://junglewise.ai/threats/cve-2026-120281-a-vulnerability-was-found-in-wavlink-wn536ax6-a-v260507-this)
- [WAVLINK WN536AX6 OS command injection in OpenVPN handler](https://junglewise.ai/threats/cve-2026-120279-a-flaw-has-been-found-in-wavlink-wn536ax6-a-v260507-the-affected)
- [WAVLINK WN536AX6-A authentication bypass in VPN client handler](https://junglewise.ai/threats/cve-2026-120278-a-vulnerability-was-detected-in-wavlink-wn536ax6-a-v260507-2-0-0)
- [WAVLINK WN536AX6-A OS command injection in WireGuard CLI handler](https://junglewise.ai/threats/cve-2026-120277-a-security-vulnerability-has-been-detected-in-wavlink-wn536ax6-a)
- [WAVLINK WN536AX6-A OS command injection in web management interface](https://junglewise.ai/threats/cve-2026-120276-a-weakness-has-been-identified-in-wavlink-wn536ax6-a-v260507-2-0)