# CVE-2026-120282: WAVLINK WN536AX6-A protocol.csp host_black os command injection

Status: published. Published: 2026-11-02. Updated: 2026-11-02.

A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- WAVLINK / WN536AX6-A: V260507 (affected). Source: CNA: VulDB

## Severity and prioritization

- CVSS 4.0: 9.4 (critical); CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P; source: CNA: VulDB

- CVSS 3.1: 9.9 (critical); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R; source: CNA: VulDB

- CVSS 3.0: 9.9 (critical); CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R; source: CNA: VulDB

- CVSS 2.0: 9 (critical); AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR; source: CNA: VulDB

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-78, CWE-77

## Exploit evidence

- exploit: https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_mac.md (CNA: VulDB)

## References

- https://vuldb.com/vuln/429626 (CNA: VulDB; vdb-entry, technical-description)

- https://vuldb.com/vuln/429626/cti (CNA: VulDB; signature, permissions-required)

- https://vuldb.com/cve/CVE-2026-120282 (CNA: VulDB; third-party-advisory)

- https://vuldb.com/submit/919791 (CNA: VulDB; third-party-advisory)

- https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN536AX6-A/WN536AX6-A_mac.md (CNA: VulDB; exploit)

## Provenance

- CNA: VulDB: https://www.cve.org/CVERecord?id=CVE-2026-120282; retrieved 2026-11-02; source updated 2026-11-02

Revision: fdaf31cbe8b938f60976ad2cfc92d4b1c4c1a977a4e0b19729886a528589204d

Canonical: https://y2.dev/cve/CVE-2026-120282