CVE-2026-120231
Received Received - Intake

Command Injection in WAVLINK WN553X1-B Router

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulDB

Description
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120231

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WAVLINK WN553X1-B V260403_2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120231 is a command injection flaw in WAVLINK WN553X1-B routers running firmware V260403_2.0.0. The vulnerability exists in the OpenVPN CLI Handler component, specifically in the /bin/ioos file. An attacker with a valid session can send a crafted HTTP POST request to the /protocol.csp endpoint with the opt=openvpn_cli parameter. The file_id parameter is not properly sanitized before being passed to a system command via popen, allowing shell metacharacters to execute arbitrary OS commands with root privileges.

Detection Guidance

To detect this vulnerability, check if your WAVLINK WN553X1-B router is running firmware version V260403_2.0.0. Test for the command injection flaw by sending a crafted HTTP POST request to /protocol.csp with opt=openvpn_cli and a malicious file_id parameter. Monitor for unexpected system command execution or file writes.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the affected router with root privileges. This can lead to full device compromise, including unauthorized access, data theft, network traffic interception, or turning the device into a botnet node. Attackers can also change router settings, install malicious firmware, or use the device as a pivot to attack other systems on the network.

Compliance Impact

This vulnerability can lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, and a compromised router could expose such data. HIPAA mandates safeguards for protected health information, which could be at risk if the router is used in a healthcare environment. The lack of proper security controls violates these regulations.

Mitigation Strategies

Immediately update the router firmware to a patched version if available. Change the default admin password to a strong, unique one. Disable remote access to the router's web interface if not required. Monitor network traffic for suspicious activity targeting the /protocol.csp endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120231. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...