WAVLINK WN553X1-B
CVE-2026-120240
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege credentials
-
DeliveryAccess WireGuard CLI group handler
-
ExploitInject OS command via group_id/group_name
-
Executionsub_41A748 in /bin/ioos executes payload
-
ImpactFull router compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated low-privilege access to the device's WireGuard CLI group management functionality (CVSS PR:L); the attacker must be able to supply the group_id or group_name arguments that reach sub_41A748 in /bin/ioos on firmware V260403_2.0.0 of the WAVLINK WN553X1-B. The need for valid credentials/session on the management plane and the specificity to this model and firmware are the primary limiting factors; no user interaction is required (UI:N) and the attack is reachable over the network (AV:N), so an attacker who has obtained even limited device access can escalate to full command execution. |
| Impact | This is a genuine high-severity issue but not a confirmed widespread-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low-privilege authentication, mapping to full compromise (VC:H/VI:H/VA:H) consistent with CWE-78 OS command injection yielding code execution on the device. The supplied signals align internally: the vendor-assigned score of 8.6 with E:P (PoC-level exploit maturity) matches the vuln.today 'this_week' decision label - serious, but one tier below act_now/emergency. It is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation; a public PoC reference exists but is not verified as working exploit code, so POC availability must not be conflated with in-the-wild use. The one point to verify: the PR:L requirement means an attacker needs some authenticated access to the router, which materially limits remote mass exploitation compared to a PR:N flaw - confirm the privilege level required by the WireGuard group handler with the vendor. |
| Exploit ScenarioDerived | An attacker with low-privileged authenticated access to the WAVLINK WN553X1-B management interface submits a crafted group_id or group_name value to the WireGuard CLI group handler, which the sub_41A748 function in /bin/ioos passes unsanitized into an OS command. The injected command executes on the router with the privileges of the handling process, granting device takeover. A public PoC reference exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 01, 2026
OS command injection in the WAVLINK WN553X1-B WireGuard CLI group handler lets an attacker with low-privilege authenticated access pass crafted group_id or group_name values that are executed as operating-system commands by /bin/ioos (sub_41A748) on firmware V260403_2.0.0. The flaw is remotely reachable, requires no user interaction, and can yield high confidentiality, integrity, and availability impact on the device. A public PoC reference exists; it is not verified as working exploit code, and the issue is high severity and prioritized for this week rather than a confirmed widespread-exploitation emergency.
Earlier versions of this analysis (1)
OS command injection in the WireGuard CLI group handler of the WAVLINK WN553X1-B router (firmware V260403_2.0.0) lets an attacker who holds a low-privileged authenticated session pass crafted group_id or group_name values into /bin/ioos (sub_41A748) and have them executed as shell commands, yielding high confidentiality, integrity and availability impact that also crosses into other security scope components. The attack is network-reachable with low complexity and no user interaction, but requires valid credentials on the management interface and access to the WireGuard group-management feature, so mass unauthenticated exploitation against default configurations is not indicated. A public PoC reference exists in a GitHub repository write-up; it is not verified as working exploit code, and no CISA KEV entry or other confirmation of active exploitation was provided. Vuln.today prioritises this as act_now and our independent assessment rates it a genuine high-priority issue rather than a CVSS-inflated one.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the supplied data at time of analysis; contact WAVLINK and monitor the VulDB advisory at https://vuldb.com/vuln/429599 for a fixed release. Until a fix is available, restrict reachability of the device management plane and WireGuard CLI group functionality to trusted networks by placing the router behind a firewall or VPN and not exposing its management interface to untrusted networks; this reduces exposure but prevents remote administration from those networks. Enforce unique strong administrator credentials and remove unnecessary low-privilege accounts so that PR:L access is harder to obtain; this does not remove the command injection once an attacker has access. If WireGuard CLI group management is not required, disable or avoid that feature where the firmware permits it, accepting that group management becomes unavailable.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-78 improper neutralization of special elements used in an OS command, in the WireGuard CLI group management path of the embedded /bin/ioos binary. The affected function sub_41A748 processes group_id/group_name arguments; manipulation of those arguments reaches command execution. The CPE cpe:2.3:a:wavlink:wn553x1-b:*:*:*:*:*:*:*:* identifies the WAVLINK WN553X1-B product, with firmware V260403_2.0.0 as the reported target. The independent assessment maps the issue to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, requires authenticated low privileges, and no user interaction. The exact parsing or sanitization failure that permits shell metacharacters is not described in the available sources.
Know when Wn553X1 B gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable (AV:N), low complexity (AC:L); requires authenticated low-privilege access to the group handler (PR:L); command injection yields full code execution on the device, so C/I/A High with scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Executive ViewAI
CVE-2026-120240 is a high-severity OS command injection in WAVLINK WN553X1-B WireGuard CLI group handler on firmware V260403_2.0.0. An attacker with low-privilege authenticated access can execute arbitrary OS commands, compromising confidentiality, integrity, and availability of affected devices. Leadership should care because these devices may serve as network entry points, and exploitation could lead to unauthorized access and service disruption.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to the WireGuard CLI, disabling the CLI group handler if not required, and enforcing strong authentication and least privilege for CLI users.
Threat Intelligence Overview
NVD
CVE.org
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)CVE.org
Authenticated low-privilege users of the WAVLINK WN553X1-B router (build V260403_2.0.0) can inject operating system comm
OS command injection in the ovpn_file handler of the WAVLINK WN553X1-B router (firmware 260403_2.0.0) allows an authenti
OS command injection in the OpenVPN CLI handler of WAVLINK WN553X1-B firmware V260403_2.0.0 allows a remote attacker hol
OS command injection in WAVLINK WN553X1-B firmware V260403_2.0.0 lets a remote attacker with a low-privilege authenticat
OS command injection in WAVLINK WN553X1-B firmware 260403_2.0.0 allows remote attackers with high-privilege administrati
Exploit-DB