CVE-2026-120278
Received Received - Intake

Authentication Bypass in WAVLINK WN536AX6-A VPN Client

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulDB

Description
A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. Impacted is the function sub_416d48/sub_41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120278

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WAVLINK WN536AX6-A V260507_2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120278 is a vulnerability in the WAVLINK WN536AX6-A router affecting the VPN Client List Handler in the /bin/ioos component. It allows unauthenticated remote attackers to access VPN client configurations due to missing authentication checks in the openvpn_cli_list and wireguard_cli_list functions.

Detection Guidance

To detect this vulnerability, check if the WAVLINK WN536AX6-A router responds to POST requests to /index.csp with endpoints openvpn_cli_list or wireguard_cli_list without authentication. Use curl commands like: curl -X POST http://<router-ip>/index.csp -d 'openvpn_cli_list' or curl -X POST http://<router-ip>/index.csp -d 'wireguard_cli_list'. If JSON data with VPN configurations is returned, the system is vulnerable.

Impact Analysis

This vulnerability enables attackers to remotely access sensitive VPN configuration details without authentication. Attackers could use this information for reconnaissance to launch further attacks like command injection or target disclosed VPN infrastructure.

Mitigation Strategies

Immediately update the router firmware to the latest version if a patch is available. Disable remote access to the router if not required. Block external access to /index.csp endpoints via firewall rules. Monitor network traffic for suspicious POST requests to these endpoints. Contact WAVLINK support for official patches or mitigations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120278. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...