CVE-2026-120277 — WAVLINK WN536AX6-A WireGuard CLI handler has command injection with a public exploit

48/100

WAVLINK WN536AX6-A V260507_2.0.0 has remote OS command injection through group_name in the WireGuard CLI Group Handler function sub_41a1d8 in /bin/ioos. An exploit is public; authentication requirements, deployment prerequisites and fixed versions need checking in the supplier advisory.

• CVSS 9.3
• CWE-77

Digest of 2026-11-02

Sources

• NVD — critical CVEs (CVSS ≥ 9) — CVE-2026-120277 (CVSS 9.3)