Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-120238

OS Command Injection in WAVLINK WN553X1-B ovpn_file Handler

CVSS 4.0
8.6 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-120238 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

WAVLINK WN553X1-B 260403_2.0.0 has an OS command injection flaw in sub_4162A8 of /bin/ioos within the ovpn_file Handler. Manipulating the file_id argument triggers it. Attackers can execute arbitrary commands remotely without authentication or user interaction, affecting the specific device.

What to do: Upgrade to a patched version if available. Vendor has been contacted.

ProductAffected
WAVLINK WN553X1-B260403_2.0.0
Estimated exposure
nicheNo basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

Weakness
CWE-77, CWE-78
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD CVE.org GitHub PoCs EPSS (—)

In the news

0 stories

No ingested article mentions this CVE yet.