CVE-2026-120276
Critical · 10.0CVSS
10.0
EPSS
3.2%
Published
Nov 2, 2026
CISA due date
—
The record
A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-95727 A command injection vulnerability exists in HPE Networking VIA. CWE-77
- CVE-2026-105982 Improper input validation in the IPsec VPN function may allow a remote attacker with high… CWE-77
- CVE-2026-105980 Improper input validation in the WireGuard VPN function may allow a remote attacker with… CWE-77
- CVE-2026-105979 Improper input validation in the ZeroTier VPN function may allow a remote attacker with… CWE-77
- CVE-2026-120345 A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. CWE-77
- CVE-2026-120344 A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. CWE-77
- CVE-2026-120282 A vulnerability was determined in WAVLINK WN536AX6-A V260507. CWE-77
- CVE-2026-120279 A flaw has been found in WAVLINK WN536AX6-A V260507. CWE-77