EUVD-2026-114914
GHSA-rg96-pw5p-hj64
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router web interface over network
-
DeliverySend crafted request to /protocol.csp
-
ExploitOverflow stack buffer via openvpn_ip strcpy
-
ExecutionHijack control flow / execute code
-
ImpactFull compromise of router
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The flaw is in the OpenVPN Handler reached via the /protocol.csp endpoint on the device's management interface; exploitation requires sending an overlong value in the openvpn_ip argument to trigger the unsafe strcpy. The CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N, indicating remote, unauthenticated exploitation with no user interaction against the affected WAVLINK WN536AX6-A V260507. The available source does not state whether the OpenVPN feature must be explicitly enabled/configured for the handler to be reachable, nor whether the management interface is exposed to the WAN by default - both are realistic limiting factors (an interface reachable only from the LAN would restrict attackers to the local network segment). Exploitation is confined to this specific router model and firmware version. |
| Impact | Signals are mixed in a way worth stating plainly. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with full High vulnerable-system impact, score 9.3) describes a remote, unauthenticated, low-complexity memory-corruption flaw with maximal technical impact - on paper a top-priority issue, and the vuln.today Decision label is 'act_now', with CVSS 4.0 exploit maturity set to E:P (Proof-of-Concept). However, the corroborating signals are thinner than the headline score suggests: the single intelligence source is VulDB, there is NO CISA KEV listing (no confirmed active exploitation), and NO EPSS score is provided, so widespread or automated exploitation cannot be asserted. The listed exploit is a GitHub write-up referenced as a PoC, not verified as working exploit code. The affected product is a specific consumer/SOHO WAVLINK router model, which caps real-world blast radius compared with enterprise software of the same CVSS. Net: treat as a genuine high-severity, act-now issue for anyone running this exact device with its web interface exposed, but the absence of KEV and EPSS data means the current evidence points to a credible-but-not-yet-proven-mass-exploited condition rather than confirmed in-the-wild abuse. |
| Exploit ScenarioDerived | An attacker with network reachability to the router's web management interface sends a crafted request to /protocol.csp targeting the OpenVPN Handler with an overlong openvpn_ip argument, overflowing a stack buffer via the unsafe strcpy call. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is required, and successful memory corruption can lead to arbitrary code execution on the device. A public PoC reference exists (GitHub write-up), though it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 02, 2026
Remote, unauthenticated stack-based buffer overflow in the OpenVPN handler of the WAVLINK WN536AX6-A router (firmware V260507) lets an attacker who can reach the /protocol.csp endpoint corrupt stack memory by supplying an overlong openvpn_ip value to an unsafe strcpy, with high confidentiality, integrity and availability impact. Only this model and firmware build are identified in the affected CPE, and a public PoC reference exists at github.com/F-yyjy/cve (WN536AX6-A_openvpn_ip.md) but is not verified as working exploit code; no KEV listing is reported. Real-world exposure hinges on reachability - the available sources do not confirm whether OpenVPN must be enabled or whether the management web interface is exposed to the WAN, so LAN-only deployments are materially less exposed, and the current triage label is act_now.
Earlier versions of this analysis (1)
Stack-based buffer overflow in WAVLINK WN536AX6-A firmware V260507 allows remote attackers to corrupt memory through the OpenVPN Handler at /protocol.csp by supplying an oversized openvpn_ip value to a strcpy call. The issue is rated CVSS 10.0 under CVSS 4.0, and the vector rates it unauthenticated (PR:N) with no user interaction, although whether an authenticated web UI session is required is not confirmed by the available sources; an independent assessment maps it to CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A public PoC reference exists; it is not verified as working exploit code, and there is no confirmed active exploitation (CISA KEV) at time of analysis.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the available data; the vendor was contacted early about the disclosure, so the VulDB entry at https://vuldb.com/vuln/429625 should be re-checked for a firmware update before applying other measures, and only a vendor fix removes the unsafe strcpy completely. Until then, block untrusted access to the management interface: do not expose the router's web UI / /protocol.csp endpoint to the WAN, and restrict it to a trusted administrative LAN or VLAN via firewall rules - this is the highest-value control because exploitation requires reaching the endpoint, though it does not help if the attacker is already inside that segment. Disabling the OpenVPN feature if it is not in use reduces the attack surface of the handler, but the sources do not confirm that the handler becomes unreachable when OpenVPN is off, so treat this as partial. Monitor router logs and any IDS/IPS for oversized or malformed openvpn_ip parameters posted to /protocol.csp, and plan a firmware upgrade as soon as WAVLINK publishes one given the act_now triage label and the existence of a public PoC reference.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-121, a stack-based buffer overflow, rooted in an unbounded strcpy of the openvpn_ip argument inside the OpenVPN Handler served through /protocol.csp on the device's embedded web management interface. Because the copy length is not validated against the destination stack buffer, an oversized openvpn_ip value overwrites adjacent stack memory, which in an embedded router httpd-style process typically leads to crash or control-flow hijack depending on the payload; the supplied sources do not describe the precise trigger mechanics beyond the strcpy manipulation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) agree that exploitation is remote and requires no privileges or user interaction once the endpoint is reachable. The CPE cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*: binds the issue to the WN536AX6-A hardware line on firmware V260507; two genuine limiting factors are not resolved by the evidence: whether the OpenVPN feature must be explicitly enabled for the handler to be reachable, and whether /protocol.csp is exposed on the WAN side by default rather than restricted to the LAN.
Know when Wn536Ax6 A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Remote unauthenticated stack overflow in a network-reachable handler with no user interaction (AV:N/AC:L/PR:N/UI:N); code execution on the single device yields full C/I/A, scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Technical POC Analysis
CWE-121 stack-based buffer overflow.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
A critical vulnerability in the WAVLINK WN536AX6-A router (firmware V260507) allows remote, unauthenticated attackers to cause a stack buffer overflow, potentially leading to full device compromise. This affects all organizations using this router model, particularly those with internet-facing management interfaces, and could result in data breaches, service disruption, or loss of network control. Leadership should prioritize immediate mitigation because no patch is available and exploitation could be trivial if the device is exposed.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to the /protocol.csp endpoint using firewall rules or network segmentation; disable WAN-side management and OpenVPN if not required; isolate affected devices on a separate VLAN; monitor logs for exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Related Vulnerabilities in WAVLINK WN536AX6-A Command Injection and Buffer Overflow
View all 5More in Wn536Ax6 A
View allOS command injection in the WireGuard CLI group handler of the WAVLINK WN536AX6-A router (firmware V260507_2.0.0) lets a
OS command injection in the WAVLINK WN536AX6-A web management interface allows remote attackers to execute arbitrary she
Exploit-DB