# CVE-2026-120278: WAVLINK WN536AX6-A authentication bypass in VPN client handler

Source: https://junglewise.ai/threats/cve-2026-120278-a-vulnerability-was-detected-in-wavlink-wn536ax6-a-v260507-2-0-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-120278 · Severity: medium · CVSS 5.3 · Published 2026-11-02

A remote-access router with VPN capability fails to authenticate requests to its VPN client configuration endpoints. An attacker without credentials can enumerate the router's OpenVPN and WireGuard peers, server addresses, and configuration paths, which can be used for reconnaissance before attempting further exploits or direct attacks on exposed VPN infrastructure.

Technologies: [Wavlink WN536AX6-A](https://junglewise.ai/threats/technologies/wn536ax6-a). Vendors: [Wavlink](https://junglewise.ai/threats/vendors/wavlink).

## Quick answers

**Is CVE-2026-120278 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120278 being exploited in the wild.

**How severe is CVE-2026-120278?** Medium severity, with a CVSS score of 5.3, published 2 November 2026.

**Which products and versions are affected?** Wavlink WN536AX6-A V260507_2.0.0.

**Is there a fix for CVE-2026-120278?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120278 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-120278?** Check whether you run Wavlink WN536AX6-A at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Missing authentication check (CWE-306) in the ioos binary handlers sub_416d48 (openvpn_cli_list) and sub_41a7c0 (wireguard_cli_list) within /bin/ioos. Unlike peer endpoints, these handlers skip the standard login check and return VPN client configuration as JSON (error: 0) to any network-adjacent unauthenticated caller via HTTP POST. This enables information disclosure of live VPN peer/server addresses and configuration identifiers.

## Affected products

- WAVLINK WN536AX6-A V260507_2.0.0

## Timeline

- 2026-11-02: disclosed

## References

- [https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_vpn_list_info_disclosure.md](https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_vpn_list_info_disclosure.md)
- [https://vuldb.com/cve/CVE-2026-120278](https://vuldb.com/cve/CVE-2026-120278)

## Related threats

- [WAVLINK WN536AX6-A command injection in host_black handler](https://junglewise.ai/threats/cve-2026-120282-a-vulnerability-was-determined-in-wavlink-wn536ax6-a-v260507)
- [WAVLINK WN536AX6-A stack buffer overflow in OpenVPN handler](https://junglewise.ai/threats/cve-2026-120281-a-vulnerability-was-found-in-wavlink-wn536ax6-a-v260507-this)
- [WAVLINK WN536AX6 OS command injection in OpenVPN handler](https://junglewise.ai/threats/cve-2026-120279-a-flaw-has-been-found-in-wavlink-wn536ax6-a-v260507-the-affected)
- [WAVLINK WN536AX6-A OS command injection in WireGuard CLI handler](https://junglewise.ai/threats/cve-2026-120277-a-security-vulnerability-has-been-detected-in-wavlink-wn536ax6-a)
- [WAVLINK WN536AX6-A OS command injection in web management interface](https://junglewise.ai/threats/cve-2026-120276-a-weakness-has-been-identified-in-wavlink-wn536ax6-a-v260507-2-0)