WAVLINK WN553X1-B CVE-2026-120228

Exploitation requires network access to the device's ioos Service and a low-privilege authenticated session (PR:L in the CVSS 4.0 vector), after which the attacker supplies a manipulated group_id or group_name argument processed by function sub_416D88 in /bin/ioos. No user interaction is required (UI:N) and attack complexity is low (AC:L/AT:N). The trigger is the unsanitized group_id/group_name argument specifically; the beyond-description detail of how the command string is assembled is not described in the available sources. Limiting factors: the attacker must be able to reach the management/ioos interface (typically LAN-side or an exposed admin service rather than the open internet by default) and must hold the privilege level implied by PR:L; real-world exposure depends on whether remote management is enabled.

This is a genuine, actionable issue rather than a high-score-but-low-risk artifact, though it is not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw that requires some level of authenticated privilege (PR:L), with full vulnerable-system impact (VC:H/VI:H/VA:H) - consistent with OS command injection (CWE-78) yielding device takeover. The input's vuln.today priority is 'this_week' and the exploit maturity is E:P (proof-of-concept), which aligns with the PoC signal below rather than confirmed mass exploitation. The flaw is NOT listed in CISA KEV and no EPSS score is provided, so there is no evidence of active or widespread exploitation - the realistic profile is opportunistic/targeted attacks against exposed or LAN-reachable devices. Note one tension to verify: the supplied CVSS 4.0 vector marks subsequent-system impact as H (SC:H/SI:H/SA:H), implying a scope change beyond the device, but the description only establishes command execution on the router's own OS; treat the subsequent-system escalation as unverified.

An attacker with access to the WAVLINK WN553X1-B management interface (PR:L) sends a crafted request to the ioos service that places shell metacharacters in the group_id or group_name argument, which sub_416D88 in /bin/ioos passes to an OS command without sanitization. This results in arbitrary command execution on the router. A public PoC reference exists but is not verified as working exploit code.