WAVLINK WN553X1-B CVE-2026-120238

Exploitation requires network reachability to the router's ovpn_file handler and low-privilege access (CVSS 4.0 PR:L) - i.e. the attacker must be able to reach and interact with the management interface that exposes the OpenVPN file handling function, then supply a malicious file_id argument that is passed into an OS command. No user interaction is required (UI:N) and attack complexity is low (AC:L). The primary limiting factors are the PR:L authentication requirement and the narrow exposure: the flaw is specific to the WAVLINK WN553X1-B (firmware 260403_2.0.0) and is only reachable by parties who can reach the device's web/management interface, which on most deployments is LAN-facing rather than internet-exposed unless remote management is enabled. No fixed version is listed in the available data.

This is a CWE-78 OS command injection in the ovpn_file handler (function sub_4162A8 in /bin/ioos) of the WAVLINK WN553X1-B router, reachable remotely via the file_id argument. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring some level of privilege (PR:L), with high impact to confidentiality, integrity and availability - command injection on an embedded router typically yields code execution in the device's own context. The vuln.today decision label is 'this_week', a prioritize-but-not-emergency signal, and there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation at this time. A public PoC reference exists (a GitHub writeup) but it is not verified as working exploit code, so weaponization cannot be assumed. Net: a genuinely high-severity flaw (full device compromise, authenticated-but-low-privilege remote trigger) whose real-world urgency is tempered by the limited deployment footprint of a consumer-grade WAVLINK router, the authentication requirement (PR:L), and the absence of KEV/EPSS signals indicating mass exploitation. EPSS is missing rather than low, so exploitation probability cannot be quantified from the data.

An attacker with low-level access to the router's management interface sends a crafted request to the ovpn_file handler, supplying a malicious file_id value that is passed unsanitized into a shell command, resulting in arbitrary OS command execution on the device. A public PoC reference exists but is not verified as working exploit code. Per the CVSS 4.0 vector the attack is network-based with low complexity and requires low privileges (PR:L) but no user interaction.