WAVLINK WN536AX6-A CVE-2026-120278

Exploitation requires network access to the router's management/web service exposing the VPN Client List Handler in /bin/ioos (functions sub_416d48/sub_41a7c0); the attacker manipulates the 'opt' argument on that endpoint to trigger the missing authentication check. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no credentials, user interaction, or special configuration are stated as required against default deployments of the WAVLINK WN536AX6-A V260507_2.0.0. The practical limiting factors are the narrow impact (only the VPN client list is disclosed - no integrity or availability effect) and the need for the attacker to reach the device's service interface, which on consumer routers is typically LAN-facing unless remote management is enabled; the available sources do not state whether the endpoint is exposed on the WAN by default.

This is a genuine but moderate-priority issue, not a high-severity emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated authentication bypass, but the impact is narrow: VC:L with VI:N and VA:N means only limited confidentiality loss (disclosure of the VPN client list) with no integrity or availability impact, consistent with the CWE-287 classification and the 5.5 base score. The exploit maturity is E:P (proof-of-concept), and the vuln.today decision label is 'this_month' - not 'act_now' or 'emergency' - which aligns with a real-but-non-urgent fix timeline. No EPSS score is provided and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation despite the description stating the exploit is public. The main signals are consistent (network vector, no auth, low-value information-disclosure impact); the chief uncertainty is deployment scale and whether the public write-up constitutes working exploit code - verify against the referenced GitHub advisory.

A remote attacker with network reachability to the router's management interface sends a crafted request to the VPN Client List Handler in /bin/ioos, manipulating the 'opt' argument to bypass the authentication check and read the configured VPN client list without credentials. A public PoC reference (a GitHub write-up) exists describing the request, though it is not verified as working exploit code. Exploitation requires no user interaction and succeeds against default configurations exposing the affected endpoint.