Dashboard / CVE-2026-120278

CVE-2026-120278

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 71/100
Published: 2026-11-02 Modified: 2026-11-02 First seen: 2026-11-02 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: Low
VI: None
VA: None

Description

A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. Impacted is the function sub_416d48/sub_41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

Weakness Classification (2)

Affected Software (2)

VendorProductVersion
WAVLINK WN536AX6-A V260507_2.0.0
WAVLINK WN536AX6-A V260507_2.0.0

References & Advisories (5)

https://vuldb.com/vuln/429622
vdb-entry technical-description
https://vuldb.com/submit/919506
third-party-advisory
https://vuldb.com/vuln/429622/cti
signature permissions-required

Bug Bounty Relevance

71 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

5.5 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.39%
Raw Score 0.003940
Percentile 33.8%
Date 2026-11-05

EPSS Trend

2026-11-05
0.00394
2026-11-04
0.00394
2026-11-03
0.00394

Intelligence Sources

mitre ref →
nvd ref →

External Links