---
id: "CVE-2026-120278"
kind: "vulnerability"
aliases: ["CVE-2026-120278"]
title: "WAVLINK WN536AX6-A router: VPN client list handler lacks authentication"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "iot", "router", "wavlink", "wn536ax6-a"]
not_affected_if: ["no-remote-access", "other-firmware-version"]
published_at: "2026-11-02T00:18:11+00:00"
first_seen_at: "2026-11-02T00:22:57+00:00"
updated_at: "2026-11-02T00:23:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120278", "first_seen_at": "2026-11-02T00:22:57+00:00"}]
---

# WAVLINK WN536AX6-A router: VPN client list handler lacks authentication

A flaw in the VPN Client List Handler of the WAVLINK WN536AX6-A router firmware lets a remote attacker manipulate the opt argument without authentication. A public exploit exists, so an attacker may be able to reach router functions they should not control.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the firmware version on the router admin page and compare it with `V260507_2.0.0`
- Confirm whether remote administration or VPN features are exposed to the internet

## Timeline

- 2026-11-02T00:22:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120278

## From the sources

A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. Impacted is the function sub_416d48/sub_41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_