CVE-2026-120282: Command Injection

Published Nov 2, 2026

Updated

A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function hostblack of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

Event History

Nov 2, 2026

CVE Published

via NVD·01:17 AM

Data Sourced

via NVD·01:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The CVSS vector indicates low privileges are required. Exploitation is remote and does not require user interaction.

Is exploit code publicly available?

Yes. The vulnerability description states that an exploit has been publicly disclosed and may be used.

Which affected firmware version is explicitly identified?

The reported affected product and version is WAVLINK WN536AX6-A V260507. No other versions are identified in the provided data.

CVE-2026-120282: Command Injection

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Is exploit code publicly available?

Which affected firmware version is explicitly identified?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Is exploit code publicly available?

Which affected firmware version is explicitly identified?