EUVD-2026-115068
GHSA-5m3x-rp28-cf8g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach router DNS resolution handler
-
DeliverySend crafted DNS argument data
-
ExploitInject shell metacharacters into sub_41a430
-
ExecutionExecute arbitrary OS commands
-
ImpactFull compromise of router
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, user interaction, or special attack requirement is needed: an attacker only needs network reachability to the affected WAVLINK WN551X3-A DNS Resolution Handler to supply malicious argument data to sub_41a430 in /bin/ioos. The precise mechanism by which attacker-controlled 'data' reaches the DNS resolution handler (which interface/port/protocol exposes it) is not described in the available sources. Realistic limiting factors: exploitation requires reaching the vulnerable service, which on consumer routers is often bound to the LAN or management interface, so WAN-side exposure depends on device configuration; affected scope is confined to firmware M51X3_V251020-WO-182e965 on the WN551X3-A model. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VC:H/VI:H/VA:H and the E:P (Proof-of-Concept) exploit-maturity flag describes a remotely reachable, low-complexity, unauthenticated OS command injection (CWE-78) that yields full confidentiality, integrity and availability impact - consistent with the 9.3 score and the vuln.today 'act_now' decision label. Signals partially reinforce each other but also leave gaps: a public PoC reference exists (raising practical risk) yet it is not verified as working exploit code, and there is no CISA KEV listing and no EPSS score in the provided data, so automated/widespread exploitation cannot be confirmed from these sources. The strongest counterweight to the high score is product footprint rather than exploitability: WAVLINK WN551X3-A is a consumer/SOHO router with a narrow deployment base, so this is a genuine high-severity flaw on affected units but likely targeted/opportunistic rather than mass-exploited. Net: treat as a real priority for anyone running this specific model (act_now per the input), while recognizing EPSS and KEV data are absent and the PoC is unverified. |
| Exploit ScenarioDerived | A remote attacker who can reach the router's DNS resolution handler sends crafted argument data that is passed unsanitized to the sub_41a430 function in /bin/ioos, injecting shell metacharacters that the device executes as OS commands. Because the CVSS vector is PR:N/UI:N, no authentication or user interaction is required, and successful injection grants command execution on the router. A public PoC reference exists (GitHub write-up), but it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 02, 2026
OS command injection in WAVLINK WN551X3-A firmware M51X3_V251020-WO-182e965 allows unauthenticated remote attackers who can reach the DNS Resolution Handler to manipulate the 'data' argument passed to sub_41a430 in /bin/ioos, with high confidentiality, integrity, and availability impact. The flaw is CWE-78 and carries a CVSS 4.0 score of 9.3; the vuln.today priority decision label is act_now. A public PoC reference exists; it is not verified as working exploit code.
Earlier versions of this analysis (1)
OS command injection in the DNS Resolution Handler of the WAVLINK WN551X3-A router (firmware M51X3_V251020-WO-182e965) lets remote attackers execute arbitrary shell commands on the device by manipulating the 'data' argument processed by function sub_41a430 in /bin/ioos. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, with high impact to both the vulnerable system and subsequent systems) scores 10.0, and the independent 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) concurs that exploitation requires no credentials, no user interaction, and no special conditions beyond network reachability of the affected interface. A public GitHub proof-of-concept writeup for this exact router model and DNS resolution command injection has been published; it is a reference only and has not been verified as working exploit code, and there is no KEV listing indicating confirmed exploitation, though the decision label is act_now given the severity and public disclosure.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the available data; the vendor was contacted early about the disclosure. Because exploitation requires network reachability to the DNS Resolution Handler, restrict access to the router's management and DNS-facing interfaces to trusted administrative networks and disable WAN-side management or DNS exposure where the deployed configuration permits it. These are compensating controls, not fixes: they can break legitimate remote DNS or management access and do not remove the underlying CWE-78 command-injection flaw, and the exact port or protocol for the vulnerable handler is not described in the available sources, so ACLs must be based on the device's deployed configuration. Isolate the WAVLINK WN551X3-A from sensitive network segments, monitor the VulDB entry https://vuldb.com/vuln/429670 and the public write-up for vendor updates, and apply vendor firmware when a fixed version is released.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the DNS Resolution Handler in WAVLINK WN551X3-A firmware build M51X3_V251020-WO-182e965, identified by CPE cpe:2.3:a:wavlink:wn551x3-a:*:*:*:*:*:*:*:*. The disclosure maps to CWE-78 OS Command Injection: manipulation of the 'data' argument reaches function sub_41a430 in the /bin/ioos binary and results in OS command injection. The available sources do not describe the precise trigger beyond that argument manipulation, including which interface, port, or protocol delivers attacker-controlled data to the handler. The supplied CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and E:P, and the independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The PoC reference is not verified as working exploit code, and no CISA KEV confirmation is provided.
Know when Wn551X3 A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Remote unauthenticated OS command injection with no user interaction (AV:N/AC:L/PR:N/UI:N) grants full device command execution, so C/I/A are High; scope unchanged as the router OS is both vulnerable and impacted component.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Technical POC Analysis
CWE-78: OS command injection in WAVLINK WN551X3-A firmware M51X3V251020-WO-182e965, in /bin/ioos handler sub41a430 for opt=dnsresolution.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
CVE-2026-120345 is a critical OS command injection vulnerability in WAVLINK WN551X3-A routers that allows unauthenticated remote code execution via the DNS resolution handler. This puts any network relying on these devices at risk of full compromise, including data theft and service disruption.
No vendor-released patch identified at time of analysis; interim mitigations include isolating affected devices, restricting network access to the DNS resolution handler, and monitoring for suspicious activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB