Zero Radar
← feed
CriticalVulnerabilityCVE-2026-120281updated 2 Nov 2026, 01:19 UTC

WAVLINK WN536AX6-A router: remote stack overflow in OpenVPN handler

Someone on the network could send a specially crafted request to this Wi-Fi router and crash it or potentially take control of it. Public exploit code exists.

NewOfficial source
SeverityCriticalCVSS 9.3 of 10
Being exploited?Not knownNo attacks reported so far
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted openvpn_ip value sent to router
  2. 2Request reaches handlerReachable remotely via /protocol.csp
  3. 3Unsafe copy overflows stackstrcpy writes past buffer bounds
  4. 4Router compromisedCrash or code execution possible
  5. ResultAttacker may control the router

What happened

A stack-based buffer overflow in the OpenVPN Handler component (/protocol.csp) caused by unsafe strcpy handling of the openvpn_ip argument, remotely triggerable.

Why it is dangerous: A remote attacker could crash the router or possibly run their own code on it, exposing the home or office network behind it. Anyone running this router firmware is at risk.

Are you affected?

You are affected if you run WAVLINK WN536AX6-A with firmware V260507.

WAVLINK WN536AX6-A V260507

What to do

  1. Check WAVLINK's site for a firmware update newer than V260507 and install it if available.
  2. Disable remote access and the OpenVPN feature on the router if you do not need them.
  3. Restrict admin interface access to trusted devices only and change default passwords.

Timeline

  1. 2 Nov 2026, 01:17 UTC
    Publicly disclosed
  2. 2 Nov 2026, 01:17 UTC
    Reported by NVD · NVD
  3. 2 Nov 2026, 01:19 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-120281
CVSS
9.3 / 10
Disclosed
2 Nov 2026, 01:17 UTC
On Zero Radar
2 Nov 2026, 01:19 UTC (2 min after disclosure)
Last change
2 Nov 2026, 01:19 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WAVLINK WN536AX6-A router: remote stack overflow in OpenVPN handler · Zero Radar