Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

WAVLINK WN536AX6-A router permits remote code execution

CVE-2026-120281 · published 3 days ago
Summary

The OpenVPN feature on the WAVLINK WN536AX6-A router can be tricked into overflowing its memory, allowing a remote attacker to run their own code on the device. This could let an attacker control the router or intercept network traffic. Apply the vendor’s firmware update or disable the OpenVPN function until the fix is installed.

Original advisory text
A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip res...
A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-119Buffer Overflow
CWE-121Stack-based Buffer Overflow
Timeline
Published2 Nov 2026
Updated3 Nov 2026
First seen2 Nov 2026
Sources
CVE-2026-120281 · NVD
Track software like this
Free during beta