Atomicorp WAF Research Notes
Research Update - 2026-11-02
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-120276 | WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120277 | WAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120279 | WAVLINK WN536AX6-A openvpn_cli protocol.csp os command injection | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120280 | WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120344 | WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120345 | WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120227 | WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120228 | WAVLINK WN553X1-B ioos Service sub_416D88 os command injection | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120230 | WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120231 | WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120239 | WAVLINK WN553X1-B WireGuard CLI ioos sub_419DA8 os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120240 | WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120282 | WAVLINK WN536AX6-A protocol.csp host_black os command injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120322 | Termix-SSH Termix transferToHost path traversal | 340007 , 344360 , 390709 |
| CVE-2026-120225 | Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal | 344360 , 347009 , 390709 |
| CVE-2026-120229 | WAVLINK WN553X1-B ioos sub_416B50 os command injection | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120324 | Aklivity Zilla http-filesystem Binding FileSystemServerFactory Path.resolve path traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2026-120342 | mathurvishal CloudClassroom-PHP-Project viewquery.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-120348 | dayrui XunRuiCMS Email Template Rendering Notice.php _get_tpl_content code injection | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-120349 | dayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-120343 | mathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-113429 | Gitea stored XSS through legacy Actions artifact Content-Encoding | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |