| Titel | Wavlink WN536AX6 V260507 CWE-121 |
|---|
| Beschreibung | WAVLINK WN536AX6-A routers are vulnerable to a stack-based buffer overflow in the `openvpn_ser` handler of `/protocol.csp`, triggered via the `openvpn_ip` parameter which is copied to a 16-byte stack buffer by an unbounded `strcpy()` (offset 264 to the saved return address, no stack canary). An unauthenticated attacker can crash the Web backend process (DoS) or achieve arbitrary code execution with root privileges, leveraging the default passwordless login (`FirstLogin=1`) to obtain a session token. |
|---|
| Quelle | ⚠️ https://github.com/F-yyjy/cve/blob/main/WN536AX6-A_openvpn_ip.md |
|---|
| Benutzer | yyjy (UID 100438) |
|---|
| Einreichung | 09.08.2026 17:32 (vor 3 Monaten) |
|---|
| Moderieren | 01.11.2026 08:44 (3 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 429625 [WAVLINK WN536AX6-A V260507 OpenVPN /protocol.csp strcpy openvpn_ip Pufferüberlauf] |
|---|
| Punkte | 20 |
|---|