CVE-2026-120229
Received Received - Intake

Command Injection in WAVLINK WN553X1-B Firmware

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulDB

Description
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120229

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WAVLINK WN553X1-B 260403_2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in the WAVLINK WN553X1-B router (firmware V260403_2.0.0). It exists in the /bin/ioos component where the file_id parameter is passed unsanitized to a snprintf function and executed via popen. This allows attackers to inject and execute arbitrary commands with root privileges.

Detection Guidance

To detect this vulnerability, check if your WAVLINK WN553X1-B router (firmware V260403_2.0.0) has the vulnerable /protocol.csp endpoint. Test by sending a crafted request with a malicious file_id parameter like a";/usr/bin/id>/tmp/pwn2;" to see if arbitrary commands execute. Verify if default credentials (admin/admin) grant access.

Impact Analysis

An attacker could exploit this to gain full control of the router, including executing system commands, obtaining a reverse shell, or accessing sensitive data. The attack requires an authenticated session, which can be obtained using default credentials (admin/admin).

Successful exploitation leads to complete device compromise, allowing attackers to manipulate the device, install malware, or use it as a pivot point in a network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Compromised devices may expose personal or health information, resulting in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the router firmware to the latest patched version. Disable default credentials and enforce strong passwords. Restrict access to the /protocol.csp endpoint via network segmentation or firewall rules. Monitor for unusual command execution in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120229. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...