Live › vulnerability › CVE-2026-120228
A WAVLINK WN553X1-B router firmware build (V260403_2.0.0) passes the group_id or group_name argument into an operating system command without proper checks. A remote attacker can run arbitrary commands on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 14:20 UTC. All times on this page are UTC.
Owners of a WAVLINK WN553X1-B router running firmware V260403_2.0.0. The flaw is in the ioos service (/bin/ioos), which passes group_id/group_name into an OS command. The researcher's submission calls it authenticated, so an attacker likely needs a login to the router, but the vendor has not confirmed this. Other models and firmware can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN553X1-B | vendor | V260403_2.0.0 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120228")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.