CVE-2026-120281
CriticalCVSS 10.0Summary
A vulnerability was found in WAVLINK WN536AX6-A version V260507 in the OpenVPN Handler component, in the strcpy function of /protocol.csp. Manipulation of the openvpn_ip argument results in a stack-based buffer overflow. The exploit has been made public and the attack may be launched remotely.
Risk Assessment
A remote attacker could exploit the buffer overflow to crash the service or potentially execute code on the device. The public availability of the exploit increases the risk of exploitation.
Recommendation
Restrict access to the management interface and update the firmware once the vendor releases a patch. Until then, consider disabling the OpenVPN feature on the device.
Other vulnerabilities in WAVLINK WN536AX6-A
See all- CVE-2026-120278Medium
A vulnerability was detected in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_416d48/sub_41a7c0 functions of the /bin/ioos file, within the VPN client list handler component. Manipulation of the opt argument results in missing authentication. The attack can be initiated remotely and the exploit is now public.
- CVE-2026-120282Critical
A vulnerability was determined in WAVLINK WN536AX6-A version V260507 in the host_black function of /protocol.csp. Manipulation of the mac argument causes OS command injection. The exploit has been publicly disclosed and remote exploitation is possible.
- CVE-2026-120280Critical
A vulnerability has been found in WAVLINK WN536AX6-A version V260507 in the WireGuard component, in the wireguard_cli_group handler of /protocol.csp. Manipulation of the group_id/group_name arguments leads to OS command injection. The exploit has been disclosed publicly and the attack may be initiated remotely.
- CVE-2026-120279Critical
A flaw has been found in WAVLINK WN536AX6-A version V260507 in the openvpn_cli Handler component, in an unknown function of /protocol.csp. Manipulation of the file_id argument can lead to OS command injection. The exploit has been published and the attack can be launched remotely.
- CVE-2026-120277Critical
A vulnerability was detected in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_41a1d8 function of the /bin/ioos file, related to the WireGuard CLI group handler. Manipulation of the group_name argument leads to OS command injection. The issue can be exploited remotely and a public exploit is already available.
- CVE-2026-120276Critical
A weakness was identified in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_416760 function of the /bin/ioos file, within the web management interface component. Manipulation of the group_name argument causes OS command injection. The attack can be initiated remotely and the exploit has been made publicly available.
Original NVD description (English source)
A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS