{"id":"CVE-2026-120281","kind":"vulnerability","aliases":["CVE-2026-120281"],"related":[],"title":"WAVLINK WN536AX6-A router: remote stack overflow in OpenVPN handler","description":"A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","summary":"WAVLINK WN536AX6-A firmware V260507 copies the openvpn_ip argument with strcpy into a stack buffer in /protocol.csp. VulDB says it can be attacked remotely without authentication and a public proof-of-concept exists. No exploitation in the wild is reported and no fixed firmware is known.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN536AX6-A","fixed":[],"affected":"V260507","ecosystem":"vendor"}],"ecosystems":[],"tags":["home-router","infrastructure","no-auth","openvpn","wavlink","wn536ax6-a"],"not_affected_if":["different-firmware","different-model"],"how_to_check":"- Check the firmware version on the router admin page; V260507 is the version reported vulnerable (other versions untested/unknown).\n- Per VulDB, exploitation needs no authentication. Whether OpenVPN must be enabled for the request to reach the code is not stated by any source; treat the router as exposed if its web interface (/protocol.csp) is reachable from untrusted networks.\n- Disable remote/WAN access to the router admin page.","fix":null,"status":"open","published_at":"2026-11-02T01:17:27+00:00","first_seen_at":"2026-11-02T01:23:19+00:00","triaged_at":"2026-11-02T01:24:08+00:00","updated_at":"2026-11-02T01:24:59+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-02T01:24:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN536AX6-A router: remote stack overflow in OpenVPN handler","impact":"high","summary":"The WAVLINK WN536AX6-A router firmware copies the openvpn_ip argument into a fixed stack buffer in /protocol.csp without a length check. A remote attacker can overflow that buffer, which typically lets them run code on the device.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn536ax6-a","home-router","openvpn"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs code on the router remotely","analyst_note":"Confirm whether authentication and OpenVPN enablement are required, and whether WAVLINK has released a fixed firmware version, via the NVD entry and vendor advisory.","how_to_check":"- Check the firmware version on the router admin page and compare it to `V260507`.\n- Confirm whether the OpenVPN feature is enabled on the device.","plain_action":"Check your WAVLINK WN536AX6-A router for a firmware update from WAVLINK, and install it when one is available.","needs_analyst":true,"not_affected_if":["different-model","different-firmware"],"who_is_affected":"Owners of WAVLINK WN536AX6-A routers on firmware V260507, reachable over the network through the /protocol.csp handler. The sources do not say whether the OpenVPN feature must be enabled for the request to reach the vulnerable code. Devices not running this model or firmware are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000712,"input_tokens":4142,"output_tokens":596,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether authentication and OpenVPN enablement are required, and whether WAVLINK has released a fixed firmware version, via the NVD entry and vendor advisory.","search":"'-120281':14A,17A '-2026':13A,16A '/protocol.csp':50B,99C 'a':20A 'affect':92C 'argument':42B,109C 'attack':56B,120C 'auth':27B 'authent':59B 'base':116C 'buffer':48B,117C 'compon':102C 'concept':66B 'contact':138C 'copi':38B 'could':132C 'cve':12A,15A 'disclosur':142C 'earli':139C 'exist':67B 'exploit':69B,126C 'file':98C 'firmwar':36B,78B 'fix':77B 'found':84C 'function':94C 'handler':11A,104C 'home':22B 'home-rout':21B 'infrastructur':24B 'ip':41B,111C 'known':80B 'launch':123C 'made':129C 'manipul':106C 'may':121C 'no-auth':25B 'openvpn':10A,28B,40B,103C,110C 'overflow':8A,118C 'proof':64B 'proof-of-concept':63B 'public':62B,130C 'remot':6A,57B,124C 'report':74B 'result':112C 'router':5A,23B 'say':52B 'stack':7A,47B,115C 'stack-bas':114C 'strcpi':44B,95C 'use':134C 'v260507':37B,90C 'vendor':136C 'vuldb':51B 'vulner':82C 'wavlink':1A,29B,32B,86C 'wild':72B 'without':58B 'wn536ax6':3A,19A,31B,34B,88C 'wn536ax6-a':2A,18A,30B,33B,87C","nicknames":[],"mitigations":[],"who_affected":"Owners of WAVLINK WN536AX6-A routers on firmware V260507, reachable over the network through the /protocol.csp handler. The sources do not say whether the OpenVPN feature must be enabled for the request to reach the vulnerable code. Devices not running this model or firmware are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"Check your WAVLINK WN536AX6-A router for a firmware update from WAVLINK, and install it when one is available.","first_public_at":"2026-11-02T01:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120281","severity":null,"published_at":"2026-11-02T01:17:27+00:00","modified_at":"2026-11-02T01:17:27+00:00","first_seen_at":"2026-11-02T01:23:19+00:00","fetched_at":"2026-11-02T01:23:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120281:1334","url":null,"severity":null,"published_at":"2026-11-02T01:24:59+00:00","modified_at":"2026-11-02T01:24:59+00:00","first_seen_at":"2026-11-02T01:24:59+00:00","fetched_at":"2026-11-02T01:24:59+00:00","note":"VulDB (secondary, CNA) says remote, no auth, public PoC on GitHub (link not shown on free page). WAVLINK advisory index has no entry for this CVE and no fix; vendor said to be contacted. OpenVPN-enablement requirement unconfirmed. Nothing marked verified (no vendor primary). Sibling CVEs 120276-120280 hit same model."}],"documents":[{"id":41682,"url":"https://vuldb.com/vuln/429625","title":"VulDB VDB-429625: WAVLINK WN536AX6-A openvpn_ip stack overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":39242,"url":"https://docs.wavlink.xyz/Security_Advisory/","title":"WAVLINK Security Advisory index (does not list this CVE)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}