{"id":"CVE-2026-120281","published":"2026-11-02T01:17:27.070","lastModified":"2026-11-02T01:17:27.070","description":"A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-119","CWE-121"],"vendors":[],"products":[],"references":[{"url":"https://github.com/F-yyjy/cve/blob/main/WN536AX6-A_openvpn_ip.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120281","tags":[]},{"url":"https://vuldb.com/submit/919790","tags":[]},{"url":"https://vuldb.com/vuln/429625","tags":[]},{"url":"https://vuldb.com/vuln/429625/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/F-yyjy/cve/blob/main/WN536AX6-A_openvpn_ip.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A stack-based buffer overflow in the OpenVPN handler's strcpy call within /protocol.csp allows remote attackers to overwrite the stack by sending a crafted openvpn_ip parameter, leading to potential arbitrary code execution.","exploitability":"Exploitation is straightforward and requires only network access since no authentication or user interaction is needed.","blast_radius":"Successful exploitation could allow full system compromise including remote code execution, data theft, and service disruption across any device running the vulnerable firmware.","remediation":"Upgrade to firmware version V260508 or later, as the vendor has released a fix for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["buffer-overflow","stack-overflow","rce","openvpn","firmware","remote-exploit"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:46:17.905Z"}}