EUVD-2026-114853
GHSA-5268-gj55-x6jx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low privileges to router
-
DeliveryReach OpenVPN CLI handler (sub_416568 in /bin/ioos)
-
ExploitInject OS command via file_id argument
-
ExecutionExecute arbitrary commands on device
-
ImpactFull compromise of router OS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the OpenVPN CLI Handler specifically - the function sub_416568 in /bin/ioos on WAVLINK WN553X1-B (V260403_2.0.0) - by manipulating the file_id argument to inject OS commands. Per the CVSS 4.0 vector, the attacker needs low-level privileges (PR:L), so authenticated access to the router is required; it is not a fully unauthenticated flaw. No user interaction is needed (UI:N) and attack complexity is low (AC:L) with a network attack vector (AV:N). The main limiting factor is the authentication requirement; exploitation is constrained to systems running this firmware version with the OpenVPN CLI handler reachable by the attacker. |
| Impact | This is a genuine, high-severity issue but not an emergency-tier one based on the supplied signals. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with full high impact to both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H) scores 8.6 and describes network-reachable, low-complexity OS command injection (CWE-78) requiring only low-level privileges. The signals are largely consistent rather than conflicting: PR:L indicates the attacker must be authenticated at a low level, which tempers the raw network-exploitability somewhat. There is no CISA KEV listing and no EPSS score was provided in the input, so widespread or automated exploitation cannot be confirmed from the data. A public PoC reference exists (a GitHub writeup) but it is not verified as working exploit code, so this should not be equated with active exploitation. The vuln.today priority Decision label is 'this_week', which aligns with a serious-but-not-emergency triage: a real priority to patch, but the absence of KEV/EPSS evidence and the authenticated-access requirement suggest this is not yet demonstrably mass-exploited. Note the exploitation-probability picture is incomplete - no EPSS value was supplied - so prioritization should lean on the 'this_week' label and the PR:L constraint. |
| Exploit ScenarioDerived | An attacker with low-privilege access to a WAVLINK WN553X1-B router reaches the OpenVPN CLI handler in /bin/ioos and supplies a crafted value in the file_id argument, which is passed unsanitized into an OS command, yielding arbitrary command execution on the device. Given AV:N/AC:L, this can be initiated remotely over the network with low complexity. A public PoC reference exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 01, 2026
OS command injection in the OpenVPN CLI handler of WAVLINK WN553X1-B firmware V260403_2.0.0 allows a remote attacker holding low-level (authenticated) privileges to execute arbitrary OS commands by manipulating the file_id argument processed by sub_416568 in /bin/ioos. Successful exploitation gives full compromise of confidentiality, integrity and availability on the device, which is typically positioned at the network edge. No CISA KEV entry or other confirmation of active exploitation was supplied; a public PoC reference exists, but it is not verified as working exploit code, and the vulnerability is prioritized for remediation this week rather than as an emergency.
Earlier versions of this analysis (1)
OS command injection in the OpenVPN CLI handler of WAVLINK WN553X1-B firmware V260403_2.0.0 allows a remote attacker with low-privilege authenticated access to execute arbitrary operating-system commands by manipulating the file_id argument passed to sub_416568 in /bin/ioos. Exploitation requires the OpenVPN management/CLI interface to be reachable and is not a pre-auth flaw against default configurations. The vuln.today priority is act_now; a public PoC reference exists, but it is not verified as working exploit code.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the supplied data at time of analysis; the vendor was contacted early about the disclosure, so the VulDB advisory (https://vuldb.com/vuln/429590) and its CTI page should be monitored for a firmware fix and applied as soon as WAVLINK publishes one. Because exploitation requires low-privileged authenticated access plus network reachability of the OpenVPN CLI handler, the available compensating measures are to restrict who can reach the router's administrative and OpenVPN CLI functionality - for example by removing remote/internet-facing management and limiting the management interface and VPN CLI endpoints to trusted administrative networks or hosts (trade-off: administrators lose off-network convenience access) - and to eliminate shared or default low-privilege accounts so the PR:L prerequisite is not trivially met (trade-off: credential rotation and account cleanup across managed devices). Disabling OpenVPN CLI configuration features entirely would remove the exposed handler but breaks VPN provisioning and management workflows on the device. A public PoC reference exists at https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_openvpn_cli_command_injection.md, though it is not verified as working exploit code.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an OS command injection (CWE-78) inside /bin/ioos, the WAVLINK WN553X1-B firmware binary, specifically in function sub_416568, which serves as the OpenVPN CLI handler. The file_id argument accepted through that handler is used in a way that permits injected shell commands, although the supplied sources do not describe the exact command-construction sink, any preceding validation, or the precise request format required to reach it. The CPE cpe:2.3:a:wavlink:wn553x1-b:*:*:*:*:*:*:*:* covers the WN553X1-B product line generally, while the disclosure and testing are tied to firmware build V260403_2.0.0. WAVLINK publishes CVSS 4.0 at 8.6 with AV:N/AC:L/AT:N and PR:L/UI:N; an independent CVSS 3.1 assessment scores the same issue AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, agreeing that network reachability and low-level authenticated access are the prerequisites, with no user interaction and low attack complexity. The practical constraint is therefore not technical difficulty but the need for valid low-privileged credentials plus a network path to the OpenVPN CLI functionality of the router.
Know when Wn553X1 B gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable (AV:N) low-complexity OS command injection needing low-privilege authentication (PR:L); command execution on the router gives full confidentiality, integrity and availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Technical POC Analysis
Evidence caveat up front: the supplied artifact is an advisory plus a dynamically verified PoC, not a patch diff.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
WAVLINK WN553X1-B edge routers running firmware V260403_2.0.0 contain an OS command injection flaw (CVE-2026-120231) that allows an authenticated attacker with low-level privileges to execute arbitrary commands, leading to full device compromise. As these devices sit at the network perimeter, a compromise could enable attackers to pivot internally, intercept traffic, or disrupt connectivity, putting sensitive data and operations at risk. Leadership should prioritize remediation to protect network integrity and customer trust.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict administrative access to trusted networks, disable remote management if not required, enforce strong authentication and least privilege, monitor for suspicious CLI activity, and segment affected devices from critical assets.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
OS command injection in WAVLINK WN553X1-B firmware V260403_2.0.0 lets a remote attacker with a low-privilege authenticat
OS command injection in WAVLINK WN553X1-B firmware 260403_2.0.0 allows remote attackers with high-privilege administrati
Exploit-DB