CVE-2026-120239
OS Command Injection in WAVLINK WN553X1-B V260403_2.0.0
- CVSS 4.0
- 8.6 high
- EPSS
- —
- Published
- ·
- Modified
OS command injection in the WireGuard CLI Handler's sub_419DA8 function of WAVLINK WN553X1-B allows remote manipulation of the file_id argument in /bin/ioos. This can lead to arbitrary command execution. Attackers can trigger it remotely without authentication. Affected are users of the device running firmware V260403_2.0.0.
What to do: Apply WAVLINK's update for CVE-2026-120239. No workaround provided.
| Product | Affected |
|---|---|
| WAVLINK WN553X1-B | V260403_2.0.0 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
- Weakness
- CWE-77, CWE-78
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
0 storiesNo ingested article mentions this CVE yet.