WAVLINK WN553X1-B CVE-2026-120229

Exploitation requires reaching the device's management service over the network and supplying a manipulated file_id argument to the sub_416B50 function in /bin/ioos, which fails to sanitize shell metacharacters (CWE-78). The CVSS vector sets PR:H, so administrative/high-privilege access to the WAVLINK WN553X1-B (firmware 260403_2.0.0) is a stated prerequisite - this is the primary limiting factor and means it is not an unauthenticated exploit from available data. No user interaction is required (UI:N) and attack complexity is low (AC:L/AT:N). Affected scope is confined to the specific WN553X1-B 260403_2.0.0 build identified; applicability to other firmware builds is not established in the evidence.

Signals are mixed and point to a real but conditional, non-emergency issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) describes a network-reachable, low-complexity command injection, but PR:H means the attacker must already hold high (administrative) privileges on the WAVLINK WN553X1-B, which sharply limits the unauthenticated-attacker threat model; the high VC/VI/VA and subsequent-system impacts reflect full OS command execution (root) on the device once that privilege is held. Exploit maturity is E:P (proof-of-concept), consistent with the input, which provides only a PoC reference that is NOT verified as working exploit code - so a public PoC reference exists; it is not verified as working exploit code, and this must not be read as confirmed active exploitation. This is not in CISA KEV and no EPSS score was provided, so there is no evidence of widespread or automated exploitation. The vuln.today decision label is 'this_week', indicating a prompt-but-not-emergency priority. Net: a genuine root-level command injection worth patching on a normal cycle, not a drop-everything CVSS-8.5 crisis, because exploitation presupposes existing high-privilege access to a niche consumer router. Note a discrepancy to verify: PR:H combined with a PoC referencing a 'check_pwd' function suggests the flaw may sit at or near authentication handling - confirm with the vendor whether the pre-conditions are truly administrative or weaker than PR:H implies.

An attacker who already holds administrative access to the WAVLINK WN553X1-B management interface (for example via default or reused credentials) sends a crafted request manipulating the file_id argument processed by sub_416B50 in /bin/ioos, injecting shell metacharacters that execute as root on the device. A public PoC reference exists but is not verified as working exploit code, so reliability in practice is unconfirmed. Successful exploitation yields full control of the router, enabling traffic interception, pivoting, or persistence.