Live › vulnerability › CVE-2026-120278
A flaw in the VPN Client List Handler of the WAVLINK WN536AX6-A router firmware lets a remote attacker manipulate the opt argument without authentication. A public exploit exists, so an attacker may be able to reach router functions they should not control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 00:22 UTC. All times on this page are UTC.
Devices running WAVLINK WN536AX6-A firmware V260507_2.0.0 are affected, specifically the /bin/ioos VPN Client List Handler. Exposure depends on whether the router's management or VPN interface can be reached remotely. Sources do not say whether other firmware versions are affected.
No product ranges from the sources yet.
V260507_2.0.0No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. Impacted is the function sub_416d48/sub_41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120278")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.