Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-120231

OS Command Injection in WAVLINK WN553X1-B OpenVPN CLI Handler

CVSS 4.0
8.6 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-120231 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

A remote OS command injection vulnerability exists in the OpenVPN CLI Handler of WAVLINK WN553X1-B V260403_2.0.0. Manipulation of the file_id argument in function sub_416568 of /bin/ioos allows remote command execution. Affected users run the vulnerable firmware version.

What to do: Apply WAVLINK's update for CVE-2026-120231

ProductAffected
WAVLINK WN553X1-BV260403_2.0.0
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

Weakness
CWE-77, CWE-78
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD CVE.org GitHub PoCs EPSS (—)

In the news

0 stories

No ingested article mentions this CVE yet.