The vulnerability lies in the OpenVPN Handler component of WAVLINK WN536AX6‑A firmware V260507. An attacker can supply a crafted openvpn_ip value that causes the strcpy function in /protocol.csp to overflow the stack. This stack‑based buffer overflow can allow arbitrary code execution on the device. The weakness is a classic CWE‑119 type input overflow (CWE‑121 stack‑based).

Affected devices are WAVLINK WN536AX6‑A routers running the V260507 firmware. No other models or firmware versions were listed in the advisory, so if the device model or firmware differ, review the vendor release notes for updates. The listed CPE identifies the exact product, confirming the single‑model scope.

The CVSS score is 10, indicating a critical severity. EPSS data is not available, so the exact probability of exploitation cannot be quantified, but the exploit code is publicly available. The attack can be performed remotely without local access, leveraging the OpenVPN service exposed by the device. Because the vulnerability triggers a stack overflow, once exploited the attacker may achieve full control over the router, potentially enabling network pivoting or persistent backdoors. The absence of a KEV listing does not reduce the immediacy of the threat.