CVE-2026-120281: critical vulnerability in WAVLINK WN536AX6-A
WAVLINK WN536AX6-A OpenVPN protocol.csp strcpy stack-based overflow
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 10epss 0.6%
A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Affected products
WAVLINK · WN536AX6-Apublic PoCs found — 1
cve_referencegithub.com/F-yyjy/cve/blob/main/WN536AX6-A_openvpn_ip.mdunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WAVLINK WN536AX6-A
In the same product, most dangerous first.
CVE-2026-120276CRITICALWAVLINK WN536AX6-A Web Management ioos sub_416760 os command injectionEPSS 3.2%CVE-2026-120277CRITICALWAVLINK WN536AX6-A WireGuard CLI Group ioos sub_41a1d8 os command injectionEPSS 2.5%CVE-2026-120280CRITICALWAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injectionEPSS 2.0%CVE-2026-120279CRITICALWAVLINK WN536AX6-A openvpn_cli protocol.csp os command injectionEPSS 2.0%CVE-2026-120282CRITICALWAVLINK WN536AX6-A protocol.csp host_black os command injectionEPSS 1.7%CVE-2026-120278MEDIUMWAVLINK WN536AX6-A VPN Client List ioos sub_41a7c0 missing authenticationEPSS 0.4%