CVE-2026-120281: Stack Overflow in WAVLINK OpenVPN Handler

CVE-2026-120281 describes a stack-based buffer overflow in the strcpy function of the OpenVPN Handler component in WAVLINK WN536AX6-A router version V260507. The openvpn_ip argument lacks proper validation, allowing a remote attacker to write beyond buffer boundaries and achieve arbitrary code execution. No authentication is required to exploit this flaw.

With a CVSS score of 10.0 and critical classification, this flaw represents maximum threat level. According to the National Vulnerability Database, the exploit has been made public and could already be in active use. Social media signals confirm security community attention, with at least two posts in the last 24 hours warning of the flaw and need for patches. The vendor was notified early to enable responsible disclosure.

Network administrators must act immediately: identify all WAVLINK WN536AX6-A devices in version V260507 in use; temporarily isolate them from external access, especially from untrusted networks; actively monitor remote authentication logs and management sessions; check administrative credentials for signs of unauthorized access. Once available, vendor patch must be applied as a priority.