| Title | Wavlink Router Firmware V260507_2.0.0 Exposure of Sensitive Information |
|---|
| Description | An unauthenticated information disclosure vulnerability (CWE-306 Missing Authentication for Critical Function / CWE-200 Exposure of Sensitive Information) was identified in the WAVLINK WN536AX6-A (AX6000) router, firmware M36AX6_V260507_2.0.0-WO-d173724 (OpenWrt-based, ARM aarch64/musl).
The web management interface consists of a lighttpd front-end (ports 80/443) that proxies dynamic *.csp requests to a back-end service, /bin/ioos, listening on 127.0.0.1:81 and running as root. ioos dispatches requests by the "opt" parameter. Almost every handler begins with a login check (ldr wN,[con,#0x64]; cmp #1; return error 10007 if not authenticated). The two VPN client LIST handlers are missing this check:
- fname=sys & opt=openvpn_cli_list (function sub_416d48, file /bin/ioos)
- fname=sys & opt=wireguard_cli_list (function sub_41a7c0, file /bin/ioos)
Both reply with error:0 and the configured VPN client data to ANY unauthenticated caller through the lighttpd front door. Properly gated sibling endpoints (opt=vpn_client, opt=zerotier_list, opt=wan_info) correctly return error:10007 under identical unauthenticated conditions, confirming the two list handlers are specifically missing the authentication check.
The wireguard_cli_list handler returns (field names confirmed in the disassembly via json_object_object_add) the client configuration: peer_Endpoint (VPN server address:port), file_id, file_name, group_id, enabled, city, iso, file_content, and additionally the WireGuard key material private_key, preshared_key, public_key and the PPPoE credentials pppoe_user / pppoe_passwd. The openvpn_cli_list handler returns remote (OpenVPN server address), file_id, file_name, display_name, enabled, group_id.
Proof of concept (no credentials, no token, pure remote):
POST /index.csp?token=NOT_LOGGED_IN HTTP/1.1
Host: <target>
Content-Type: application/x-www-form-urlencoded
fname=sys&opt=wireguard_cli_list&function=get
Response: { "opt":"wireguard_cli_list", "fname":"sys", "function":"get",
"clients":[ { "peer_Endpoint":"<VPN server:port>", "file_id":"...",
"file_name":"...", "group_id":"...", "enabled":"1",
"city":"...", "iso":"..." } ], "error":0 }
Impact: a network-adjacent, unauthenticated attacker can enumerate the router's configured VPN clients and disclose the VPN server endpoint (peer_Endpoint / remote), client identifiers and topology, enabling reconnaissance ahead of the authenticated command-injection exploits in the same firmware (openvpn_cli_group / wireguard_cli_group, CWE-78) or direct targeting of the disclosed VPN infrastructure. The WireGuard private key / preshared key / PPPoE password fields are present in the handler's response construction; on a device where a VPN client has been imported through the normal web flow these fields carry the live secret values (the values are supplied by the back-end mu process over IPC, not stored directly in uci).
Verification note: the vulnerability was dynamically verified against the firmware emulated with qemu-aarch64 user-mode emulation. Unauthenticated reachability (error:0 vs 10007 control) and disclosure of the client metadata (peer_Endpoint, file_id, file_name, group_id, enabled, city, iso) were confirmed by direct request. The private_key / preshared_key / pppoe_passwd / file_content field values are delivered by the back-end mu process via IPC and could not be populated in the emulator (mu holds the client list as runtime state built by the import business flow, not readable from uci); the field names are confirmed in the handler disassembly. A ready-to-run PoC is published alongside the advisory. |
|---|
| Source | ⚠️ https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN536AX6-A%20Router/WAVLINK_WN536AX6-A_vpn_list_info_disclosure.md |
|---|
| User | shuyi (UID 100431) |
|---|
| Submission | 08/09/2026 05:09 (3 months ago) |
|---|
| Moderation | 11/01/2026 08:44 (3 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 429622 [WAVLINK WN536AX6-A V260507_2.0.0 VPN Client List /bin/ioos sub_416d48/sub_41a7c0 opt missing authentication] |
|---|
| Points | 20 |
|---|