Description
A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. Impacted is the function sub_416d48/sub_41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Published: 2026-11-01
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Missing authentication that allows remote attackers to access the VPN Client List handler without authorization.
Action: Apply Patch
AI Analysis

Impact

The vulnerability resides in the WAVLINK WN536AX6-A router firmware V260507_2.0.0 within the function sub_416d48/sub_41a7c0 of the /bin/ioos component. By manipulating the opt argument the function performs the VPN Client List request without authenticating the requester, creating an authentication bypass flaw. This weakness enables an attacker to retrieve, modify or otherwise manipulate VPN client information without permission.

Affected Systems

The affected product is the WAVLINK WN536AX6-A router. The description references firmware version V260507_2.0.0; no other versions are listed as impacted.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity flaw, and the exploit is already public, making it likely to be used by adversaries. The EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalog. Attack would be initiated remotely by sending crafted requests that alter the opt parameter, bypassing authentication. The flaw maps to CWE‑287 (Authentication Bypass) and CWE‑306 (Missing Authentication).

Generated by OpenCVE AI on November 2, 2026 at 01:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • If a vendor-supplied firmware update is available that fixes the sub_41a7c0 authentication check, apply it as soon as possible.
  • In the absence of an update, restrict external access to the /bin/ioos endpoint by configuring the router’s firewall or access control lists to allow only trusted networks or by disabling the VPN Client List feature if it is unnecessary.
  • Continuously monitor system logs for unusual requests or attempts to modify the opt parameter and investigate any unauthorized activity.

Generated by OpenCVE AI on November 2, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 00:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. Impacted is the function sub_416d48/sub_41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Title WAVLINK WN536AX6-A VPN Client List ioos sub_41a7c0 missing authentication
First Time appeared Wavlink
Wavlink wn536ax6-a
Weaknesses CWE-287
CWE-306
CPEs cpe:2.3:a:wavlink:wn536ax6-a:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wn536ax6-a
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Wavlink Wn536ax6-a
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-01T23:45:16.567Z

Reserved: 2026-11-01T07:44:05.887Z

Link: CVE-2026-120278

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-02T00:18:11.003

Modified: 2026-11-02T00:18:11.003

Link: CVE-2026-120278

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T01:30:14Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function