Command Injection in WAVLINK WN553X1-B Firmware

Executive Summary

CVE-2026-120228 is a command injection flaw in the WAVLINK WN553X1-B router firmware V260403_2.0.0. It exists in the /bin/ioos component which runs as root and listens locally. The vulnerability allows authenticated attackers to execute arbitrary commands by manipulating parameters like group_id or group_name in HTTP POST requests to /protocol.csp. The flaw stems from improper input validation in functions handling user input.

Useful 0 Not Useful 0

Detection Guidance

Check if your WAVLINK WN553X1-B router is running firmware version V260403_2.0.0. Inspect network traffic for HTTP POST requests to /protocol.csp with parameters like group_id or group_name. Look for unexpected command execution artifacts such as files in /tmp or unusual processes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with valid credentials to gain root access to the router. They can execute arbitrary commands, steal data, install malware, or use the device as a pivot point for further attacks. Exploitation requires authentication but can be achieved using default credentials. Successful attacks lead to full device compromise and potential network infiltration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows remote attackers with valid credentials to execute arbitrary commands as root on the device. Such unauthorized access could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the router firmware to a patched version if available. Disable remote access to the router's web interface. Change the default admin password to a strong, unique one. Block external access to port 81 on 127.0.0.1. Monitor for suspicious activity or unauthorized commands.

Useful 0 Not Useful 0