WAVLINK WN551X3-A CVE-2026-120344

The attacker must be able to reach the WireGuard CLI Group Handler exposed by the 'system' function in /bin/ioos on a WAVLINK WN551X3-A (firmware M51X3_V251020-WO-182e965) and control the group_name argument, into which shell metacharacters are injected (CWE-78). The CVSS 4.0 vector states no authentication and no user interaction (PR:N/UI:N) are required and that the attack is network-reachable (AV:N), implying exploitation against affected units without credentials; however, the description does not explicitly state whether the handler is reachable pre-authentication, so a required admin session is a realistic limiting factor to verify. Limiting factors: exploitation is confined to this specific WAVLINK model/firmware, depends on the WireGuard configuration path being reachable from the attacker's network position, and no working exploit is verified - only a PoC reference.

Multiple signals point the same direction here. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC/VI/VA all High) describes a remotely reachable, low-complexity command injection with no authentication or user interaction stated, and the vuln.today Decision label is act_now - so this is treated as a real, high-priority issue rather than a high-score-but-low-real-risk theoretical flaw. The E:P ('Proof-of-Concept') value in the vector aligns with the intelligence note that a public PoC reference exists. Signals that would normally confirm widespread danger are, however, absent: there is NO CISA KEV listing and NO EPSS score in the provided data, so we cannot quantify real-world exploitation probability. The PoC is a reference only and is not verified as working exploit code, so exploitability in practice is plausible but not demonstrated. One caveat worth verifying with the vendor: the vector asserts PR:N (unauthenticated), but a WireGuard CLI group handler on a consumer router is commonly reachable only through an authenticated admin interface - the description does not state whether a login is required, so the unauthenticated assumption is unconfirmed. Net: a credible act_now item for anyone running this specific WAVLINK model, tempered by the fact that no active-exploitation or EPSS evidence is present and the affected product has a narrow deployment footprint.

A remote attacker reaches the router's WireGuard configuration handler in /bin/ioos and supplies a group_name value containing shell metacharacters; because the input is passed unsanitized to a system shell, the injected command runs on the device. A public PoC reference has been disclosed, and given AV:N/AC:L the request is simple to craft and requires no special timing. Successful injection yields command execution on the router, typically with high privileges.