CVE-2026-120280
Critical · 10.0CVSS
10.0
EPSS
2.0%
Published
Nov 2, 2026
CISA due date
—
The record
A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-95727 A command injection vulnerability exists in HPE Networking VIA. CWE-77
- CVE-2026-105982 Improper input validation in the IPsec VPN function may allow a remote attacker with high… CWE-77
- CVE-2026-105980 Improper input validation in the WireGuard VPN function may allow a remote attacker with… CWE-77
- CVE-2026-105979 Improper input validation in the ZeroTier VPN function may allow a remote attacker with… CWE-77
- CVE-2026-120345 A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. CWE-77
- CVE-2026-120344 A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. CWE-77
- CVE-2026-120282 A vulnerability was determined in WAVLINK WN536AX6-A V260507. CWE-77
- CVE-2026-120279 A flaw has been found in WAVLINK WN536AX6-A V260507. CWE-77