critical · CVSS v3 10 · CVSS v4 10
CVE-2026-120281
WAVLINK WN536AX6-A routers are vulnerable to a stack-based buffer overflow in the OpenVPN Handler component. The flaw is triggered by manipu
Overview
WAVLINK WN536AX6-A routers are vulnerable to a stack-based buffer overflow in the OpenVPN Handler component. The flaw is triggered by manipulating the openvpn_ip argument in /protocol.csp, allowing remote attackers to potentially execute arbitrary code. The vulnerability is rated critical with a CVSS v3 score of 10.0.
Description
A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Impact
Confidentiality: potential disclosure of sensitive data; Integrity: remote code execution could modify router configuration; Availability: service disruption or reboot. Network administrators and end users of affected WAVLINK routers are at risk.
Remediation
Apply the vendor’s firmware update that patches the strcpy buffer overflow in OpenVPN Handler. If an update is not yet available, disable the OpenVPN service or block incoming traffic to the OpenVPN port (1194 UDP/TCP) using firewall rules. Monitor firmware release notes and apply patches promptly.
Risk context
Critical severity with CVSS 10.0 indicates a high likelihood of exploitation. No EPSS data available, but the public exploit and remote nature warrant immediate attention.
Affected products
- WAVLINK WN536AX6-A
Scores
- Severity
- critical
- CVSS v2
- 10
- CVSS v3
- 10
- CVSS v4
- 10
- EPSS
- —