CVE-2026-120276: Command Injection

Published Nov 2, 2026

Updated

A weakness has been identified in WAVLINK WN536AX6-A V2605072.0.0. This vulnerability affects the function sub416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument groupname causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

Event History

Nov 2, 2026

CVE Published

via NVD·12:18 AM

Data Sourced

via NVD·12:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

The affected component is the Web Management Interface on WAVLINK WN536AX6-A devices running firmware V260507_2.0.0. Because the attack can be initiated remotely, deployments with reachable web management interfaces are exposed.

Does exploitation require authentication or user interaction?

The provided CVSS vector indicates no privileges and no user interaction are required. Attack complexity and attack requirements are also rated low and none, respectively.

What can an attacker achieve?

By manipulating the group_name argument handled by sub_416760 in /bin/ioos, an attacker can inject operating-system commands. The stated impacts include high confidentiality, integrity, and availability impact, including subsequent-system impacts.

How urgent is remediation?

The vulnerability is rated critical with a 9.3 severity score, and a public exploit is available. The vendor was contacted early about the disclosure, but no fixed version or workaround is provided in the available data.

CVE-2026-120276: Command Injection

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What can an attacker achieve?

How urgent is remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What can an attacker achieve?

How urgent is remediation?