CVE-2026-120345
Received Received - Intake

Command Injection in WAVLINK WN551X3-A Router

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulDB

Description
A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-120345

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
WAVLINK WN551X3-A M51X3_V251020-WO-182e965

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120345 is an OS Command Injection flaw in the WAVLINK WN551X3-A router firmware M51X3_V251020-WO-182e965. It exists in the /bin/ioos component's DNS Resolution Handler, which processes a user-controlled 'data' parameter via HTTP. The handler only blocks semicolons but allows newline characters, enabling command injection via shell command execution with popen(). Attackers can inject arbitrary commands by appending a newline followed by payloads, achieving root-level remote code execution.

Detection Guidance

To detect this vulnerability, check if your WAVLINK WN551X3-A router runs firmware M51X3_V251020-WO-182e965. Test for command injection by sending a POST request to /index.csp with data=8.8.8.8%0aid>/tmp/p_dns%0a and verify if /tmp/p_dns is created with root output.

Use curl: curl -X POST -d 'data=8.8.8.8%0aid>/tmp/p_dns%0a' http://<router-ip>/index.csp. If the file /tmp/p_dns exists and contains output, the system is vulnerable.

Impact Analysis

This vulnerability allows unauthenticated attackers to execute arbitrary commands as root on the affected router remotely. Impact includes full system compromise, data theft, network traffic interception, or turning the device into a botnet node. Attackers could install malware, modify router settings, or pivot to other network devices. The exploit bypasses authentication due to localhost trust mechanisms.

Compliance Impact

This vulnerability allows unauthenticated remote attackers to execute arbitrary commands as root on the affected WAVLINK WN551X3-A router. Such unauthorized root access could lead to full compromise of the device, enabling attackers to exfiltrate sensitive data, modify system configurations, or install malware. For organizations handling personal or health data, this could result in violations of GDPR (data protection) and HIPAA (privacy and security rules) due to unauthorized access and potential data breaches.

Mitigation Strategies

Immediately update the router firmware to a patched version if available. Disable remote access to the router's web interface and restrict access to trusted networks only.

Block external access to port 81 (ioos service) via firewall rules. Monitor network traffic for unusual DNS resolution requests or unexpected command execution attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120345. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...