CVE-2026-120278: Medium severity vulnerability

Published Nov 2, 2026

Updated

A vulnerability was detected in WAVLINK WN536AX6-A V2605072.0.0. Impacted is the function sub416d48/sub41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

Event History

Nov 2, 2026

CVE Published

via NVD·12:18 AM

Data Sourced

via NVD·12:18 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are affected?

The affected product identified is the WAVLINK WN536AX6-A running firmware V260507_2.0.0. The vulnerable code is in /bin/ioos within the VPN Client List Handler component.

What does an attacker need to exploit this issue?

An attacker can initiate the attack remotely by manipulating the opt argument handled by the affected functions. No authentication or user interaction is required.

Is public exploit code available?

Yes. The available data states that the exploit is public and may be used.

What is the security impact?

The issue causes missing authentication in the VPN Client List Handler. The supplied severity data rates it medium with a 5.5 score and indicates confidentiality impact without integrity or availability impact.

CVE-2026-120278: Medium severity vulnerability

Event History

Frequently Asked Questions

Which systems are affected?

What does an attacker need to exploit this issue?

Is public exploit code available?

What is the security impact?

Company

Resources

Contact

Frequently Asked Questions

Which systems are affected?

What does an attacker need to exploit this issue?

Is public exploit code available?

What is the security impact?