CVE-2026-120281 is a stack-based buffer overflow in the WAVLINK WN536AX6-A router's firmware (V260507), triggered when the OpenVPN handler's strcpy call processes the openvpn_ip argument. An attacker can reportedly trigger the overflow remotely, and a public exploit for the bug is already circulating. WAVLINK was notified of the issue ahead of the public disclosure.
// source: nvd.nist.gov ↗