CVE-2026-120239
Received Received - Intake

Command Injection in WAVLINK WN553X1-B Router

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulDB

Description
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120239

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WAVLINK WN553X1-B V260403_2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a command injection vulnerability in WAVLINK WN553X1-B routers running firmware V260403_2.0.0. It allows authenticated attackers to execute arbitrary OS commands with root privileges by manipulating the file_id parameter in a crafted HTTP POST request. The flaw exists in the sub_419DA8 function of /bin/ioos where user input is passed unsafely to snprintf and popen.

Detection Guidance

To detect this vulnerability, check if your WAVLINK WN553X1-B router is running firmware version V260403_2.0.0. Verify if the /bin/ioos file contains the sub_419DA8 function and if the file_id parameter is passed to snprintf without input validation. Monitor network traffic for POST requests to /protocol.csp?fname=system&opt=wireguard_cli&function=set with suspicious file_id values.

  • Use curl to test the endpoint: curl -X POST -d 'fname=system&opt=wireguard_cli&function=set&file_id=a;id' http://<router-ip>/protocol.csp. If the response includes command output, the vulnerability is present.
Impact Analysis

An attacker could take full control of your router, steal sensitive data, install malware, or use it as a pivot point to attack other devices on your network. Since default credentials are often unchanged, many devices are vulnerable without any additional exploitation steps.

Compliance Impact

This vulnerability allows remote attackers with valid session tokens to execute arbitrary OS commands with root privileges on affected WAVLINK routers. Such unauthorized access could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information.

Mitigation Strategies

Immediately update the router firmware to a patched version if available. Change the default credentials (username: admin, password: admin) to strong, unique passwords. Disable remote access to the router's web interface if not required. Monitor network traffic for suspicious POST requests to the vulnerable endpoint.

  • Block external access to /protocol.csp?fname=system&opt=wireguard_cli&function=set via firewall rules until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120239. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...