CVE-2026-120229
OS Command Injection in WAVLINK WN553X1-B 260403_2.0.0
- CVSS 4.0
- 8.5 high
- EPSS
- —
- Published
- ·
- Modified
WAVLINK WN553X1-B contains OS command injection in sub_416B50 of /bin/ioos when file_id is manipulated. Remote attackers can trigger it without authentication. This leads to arbitrary code execution. Affected are devices running firmware version 260403_2.0.0. The exploit is publicly disclosed.
What to do: Upgrade WAVLINK WN553X1-B firmware. No workaround provided.
| Product | Affected |
|---|---|
| WAVLINK WN553X1-B | 260403_2.0.0 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
- Weakness
- CWE-77, CWE-78
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
0 storiesNo ingested article mentions this CVE yet.