CVE-2026-120281 is a critical, remotely exploitable stack-based buffer overflow in the OpenVPN Handler of WAVLINK WN536AX6-A firmware V260507, and a public exploit is already available.
What Is It
The flaw sits in the /protocol.csp file of the device's OpenVPN Handler component. The handler passes the openvpn_ip argument to strcpy without checking its length. A crafted value overflows a stack buffer. The CNA (VulDB) maps the weakness to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-121 (Stack-based Buffer Overflow).
The NVD record is currently in "Received" status, meaning NVD has not yet completed its own analysis.
Why It Matters
The CNA-assigned scores are maximal or close to it:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL, exploit maturity rated Proof-of-Concept
- CVSS 2.0: 10.0
According to these vectors, the attack works over the network, has low complexity, and needs no privileges or user interaction. Successful exploitation can fully compromise confidentiality, integrity, and availability, and the scope is rated "changed." The description says the exploit "has been made public and could be used," and a write-up is posted on GitHub.
KEV status: There is no CISA KEV entry for this CVE. Active exploitation in the wild is not confirmed by KEV at this time.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN536AX6-A
- Affected version: V260507
- Component: OpenVPN Handler (
/protocol.csp) - CPE:
cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:*
The supplied record does not list any other firmware versions as affected or unaffected.
Patch Status
The supplied records contain no vendor advisory, fixed firmware version, or remediation guidance. The disclosure notes only that the vendor was contacted early. Because there is no KEV entry, there is no CISA required action or due date. Owners of WN536AX6-A devices running V260507 should check WAVLINK's channels for a firmware update and track the VulDB entry for changes.