{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wn536ax6-a-v260507/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wavlink:wn536ax6_a:*:*:*:*:*:*:*:*","cpe:2.3:h:wavlink:wn536ax6-a:v260507_2.0.0:*:*:*:*:*:*:*","cpe:2.3:h:wavlink:wn536ax6-a:v260507:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2026-120276"},{"cvss":10,"id":"CVE-2026-120277"},{"cvss":10,"id":"CVE-2026-120280"},{"cvss":10,"id":"CVE-2026-120281"},{"cvss":9.9,"id":"CVE-2026-120282"},{"cvss":10,"id":"CVE-2026-120279"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["WN536AX6-A (V260507_2.0.0)","WN536AX6-A (V260507)"],"_cs_severities":["critical"],"_cs_tags":["RCE","Command Injection"],"_cs_type":"advisory","_cs_vendors":["WAVLINK"],"content_html":"\u003cp\u003eA weakness has been identified in the Web Management Interface of the WAVLINK WN536AX6-A (version V260507_2.0.0). The vulnerability resides in function 'sub_416760' of the file '/bin/ioos'. Manipulation of the 'group_name' argument allows for remote OS command injection. Public exploit code is available for this vulnerability. The vendor was contacted early regarding this disclosure.\u003c/p\u003e\n","date_modified":"2026-11-02T05:17:07Z","date_published":"2026-11-02T01:01:37Z","id":"https://feed.craftedsignal.io/briefs/2026-11-wavlink-wn536ax6a-rce/","summary":"A remote OS command injection vulnerability exists in the WAVLINK WN536AX6-A router, version V260507_2.0.0.","title":"WAVLINK WN536AX6-A: Remote command injection (CVE-2026-120276)","url":"https://feed.craftedsignal.io/briefs/2026-11-wavlink-wn536ax6a-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - WN536AX6-a (V260507)","version":"https://jsonfeed.org/version/1.1"}