CVE-2026-120238
Received Received - Intake

Command Injection in WAVLINK WN553X1-B Firmware

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulDB

Description
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120238

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WAVLINK WN553X1-B 260403_2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120238 is an authenticated command injection vulnerability in the WAVLINK WN553X1-B router running firmware version V260403_2.0.0. The flaw exists in the sub_4162A8 function of the /bin/ioos service, where user input in the file_id parameter is not properly sanitized before being passed to the popen function. This allows attackers with a valid session to execute arbitrary operating system commands with root privileges.

Detection Guidance

To detect this vulnerability, check for unusual network traffic or requests to the /protocol.csp endpoint with crafted parameters. Monitor logs for unexpected command execution or file modifications. Use network scanning tools to identify devices running vulnerable firmware versions.

Impact Analysis

An attacker could gain full control over the affected router, execute arbitrary commands, delete files, or install malware. Since the device uses default admin credentials, attackers can easily obtain a session token to exploit this flaw remotely. This could lead to network compromise, data theft, or turning the device into a botnet node.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using this router may face compliance violations, legal penalties, and reputational damage due to potential exposure of sensitive data.

Mitigation Strategies

Immediately update the router firmware to the latest version if available. Disable remote access to the router's web interface. Change the default admin password to a strong, unique one. Block external access to the /protocol.csp endpoint if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120238. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...