WAVLINK WN553X1-B CVE-2026-120239

Exploitation requires authenticated access to the WireGuard CLI handler of the WN553X1-B management interface at a low privilege level (CVSS 4.0 PR:L), and the specific trigger is supplying attacker-controlled input in the file_id argument processed by function sub_419DA8 in /bin/ioos. Limiting factors: the attacker must first hold valid low-privilege credentials or an authenticated session (not unauthenticated), and the device's management/WireGuard interface must be network-reachable to the attacker - exposure is greatest where the admin plane or WireGuard service is reachable beyond the trusted LAN. The precise set of conditions under which /bin/ioos reaches the vulnerable path (e.g. whether WireGuard must be configured/enabled) is not detailed in the available sources. The affected build is identified as V260403_2.0.0.

This is a credible, near-term priority rather than a CVSS-inflated non-issue, but its real-world blast radius is constrained. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity OS command injection (CWE-78) in the WireGuard CLI handler of the WAVLINK WN553X1-B router, and CVSS 4.0 PR:L means the attacker is authenticated at a low privilege level - so this is NOT an unauthenticated flaw. Supporting signals are mixed: the vendor-assigned score is 8.6 (High) with CVSS 4.0 exploit maturity E:P (Proof-of-Concept), the vuln.today decision label is 'this_week' (elevated but below act_now/emergency), and a public PoC reference exists on GitHub. However, this is NOT in CISA KEV, there is no confirmed active exploitation, and no EPSS score was supplied - so exploitation probability cannot be quantified from the data. The reporting source is VulDB (also the assigner/CNA), and all substantive references trace back to VulDB plus a single third-party PoC write-up, so this is effectively a single-source disclosure with limited independent corroboration. Net: treat as a genuine this_week patch/triage item for exposed WN553X1-B devices, tempered by the facts that it requires authentication (PR:L), the product footprint is small, and the PoC is unverified.

An attacker who already holds low-privilege authenticated access to the WN553X1-B management interface (e.g. valid low-tier credentials, default/weak credentials, or a session on the LAN/exposed admin plane) sends a crafted value in the file_id argument to the WireGuard CLI handler in /bin/ioos, which is passed unsanitized into an OS command and executed on the router. A public PoC reference exists on GitHub but is not verified as working exploit code; the low attack complexity (AC:L) means that if the PoC is functional, reliable exploitation requires little attacker skill once authenticated.