{"id":"CVE-2026-120228","kind":"vulnerability","aliases":["CVE-2026-120228"],"related":[],"title":"WAVLINK WN553X1-B router: remote command injection via group_id parameter","description":"A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.","summary":"A WAVLINK WN553X1-B router firmware build (V260403_2.0.0) passes the group_id or group_name argument into an operating system command without proper checks. A remote attacker can run arbitrary commands on the device.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN553X1-B","fixed":[],"affected":"V260403_2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-likely-required","home-router","infrastructure","iot","wavlink","wn553x1-b"],"not_affected_if":["other-firmware-versions","other-router-models"],"how_to_check":"- Check the firmware version on the router admin page; V260403_2.0.0 is the only version reported vulnerable. Other versions are untested, not cleared.\n- Check that the router admin interface is not exposed to the internet (WAN/remote management off).","fix":null,"status":"open","published_at":"2026-11-01T14:18:52+00:00","first_seen_at":"2026-11-01T14:20:23+00:00","triaged_at":"2026-11-01T14:22:12+00:00","updated_at":"2026-11-01T14:23:40+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-01T14:22:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN553X1-B router: remote command injection via group_id parameter","impact":"high","summary":"A WAVLINK WN553X1-B router firmware build (V260403_2.0.0) passes the group_id or group_name argument into an operating system command without proper checks. A remote attacker can run arbitrary commands on the device.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn553x1-b","home-router","iot"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs operating system commands on the router remotely.","analyst_note":"Check the NVD entry and vendor advisory for a fixed firmware version and whether authentication is required to reach the ioos service.","how_to_check":"- Check the firmware version on the device admin page against `V260403_2.0.0`\n- unknown for other checks: the sources do not say whether the ioos service is enabled by default","plain_action":"If you own a WAVLINK WN553X1-B router, check its firmware version and watch for a vendor update, since the sources give no fixed version yet.","needs_analyst":true,"not_affected_if":["other-router-models","other-firmware-versions"],"who_is_affected":"Devices running WAVLINK WN553X1-B firmware V260403_2.0.0, where the ioos service at /bin/ioos handles the group_id or group_name argument. Networks that do not run this router model or firmware can skip it. The sources do not say whether the flaw needs a logged-in session.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000708,"input_tokens":4152,"output_tokens":586,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and vendor advisory for a fixed firmware version and whether authentication is required to reach the ioos service.","search":"'-120228':15A,18A '-2026':14A,17A '/bin/ioos':93C '2.0.0':44B,82C '416d88':89C 'affect':85C 'arbitrari':66B 'argument':52B,104C 'attack':63B,114C 'auth':23B 'auth-likely-requir':22B 'b':4A,21A,34B,39B,80C 'build':42B 'check':60B 'command':7A,57B,67B,111C 'compon':96C 'contact':131C 'cve':13A,16A 'devic':70B 'disclosur':135C 'earli':132C 'execut':99C,117C 'exploit':120C 'file':92C 'firmwar':41B 'flaw':72C 'found':75C 'function':87C 'group':10A,47B,50B,105C 'home':27B 'home-rout':26B 'id':11A,48B 'id/group_name':106C 'infrastructur':29B 'inject':8A,112C 'ioo':97C 'iot':30B 'lead':108C 'like':24B 'manipul':101C 'may':125C 'name':51B 'oper':55B 'os':110C 'paramet':12A 'pass':45B 'proper':59B 'publish':123C 'remot':6A,62B,118C 'requir':25B 'router':5A,28B,40B 'run':65B 'servic':98C 'sub':88C 'system':56B 'use':127C 'v260403':43B,81C 'vendor':129C 'via':9A 'vulner':84C 'wavlink':1A,31B,36B,77C 'without':58B 'wn553x1':3A,20A,33B,38B,79C 'wn553x1-b':2A,19A,32B,37B,78C","nicknames":[],"mitigations":[],"who_affected":"Owners of a WAVLINK WN553X1-B router running firmware V260403_2.0.0. The flaw is in the ioos service (/bin/ioos), which passes group_id/group_name into an OS command. The researcher's submission calls it authenticated, so an attacker likely needs a login to the router, but the vendor has not confirmed this. Other models and firmware can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a WAVLINK WN553X1-B router, turn off remote management, use a strong admin password, and watch WAVLINK's site for a firmware update.","first_public_at":"2026-11-01T14:18:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120228","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120228","severity":null,"published_at":"2026-11-01T14:18:52+00:00","modified_at":"2026-11-01T14:18:52+00:00","first_seen_at":"2026-11-01T14:20:23+00:00","fetched_at":"2026-11-01T14:20:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120228:1303","url":null,"severity":null,"published_at":"2026-11-01T14:23:40+00:00","modified_at":"2026-11-01T14:23:40+00:00","first_seen_at":"2026-11-01T14:23:40+00:00","fetched_at":"2026-11-01T14:23:40+00:00","note":"VulDB (third party) describes it; researcher submission titled 'Authenticated Command Injection', CVSS has PR:L, so a login is likely needed (not vendor-confirmed). Public PoC on GitHub per VulDB (link locked, not read). WAVLINK advisory index has no entry for WN553X1-B and no fix found; nothing verified."}],"documents":[{"id":39241,"url":"https://vuldb.com/vuln/429587","title":"VulDB VDB-429587: WAVLINK WN553X1-B ioos group_id/group_name command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":39242,"url":"https://docs.wavlink.xyz/Security_Advisory/","title":"WAVLINK Security Advisory index (no entry for this CVE)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}