CVE-2026-120344
Deferred Deferred - Pending Action

Command Injection in WAVLINK WN551X3-A via WireGuard CLI

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulDB

Description
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120344

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WAVLINK WN551X3-A M51X3_V251020-WO-182e965

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an OS command injection flaw in the WAVLINK WN551X3-A router's WireGuard CLI Group Handler. It exists in the /bin/ioos component where the group_name parameter is not properly sanitized. Attackers can inject malicious commands via crafted input like a';CMD;', which get executed with root privileges through the system() function.

Detection Guidance

Check if the router's web interface is accessible at 127.0.0.1:81. Test the WireGuard CLI group handler by sending a crafted payload to the group_name parameter. Look for unexpected command execution or file modifications.

Impact Analysis

This vulnerability allows unauthenticated remote attackers to execute arbitrary commands with root privileges on the device. Potential impacts include full device compromise, credential theft, LAN pivoting for further attacks, and persistent backdooring of the router. Attackers can also write files or establish reverse shells.

Compliance Impact

This vulnerability allows unauthenticated remote code execution with root privileges, enabling full device compromise. Such unauthorized access could lead to unauthorized data access, modification, or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information.

Mitigation Strategies

Disable remote access to the router's web interface. Update the router firmware if a patch is available. Change the default admin password. Block external access to port 81 on the router.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120344. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...