---
id: "CVE-2026-120228"
kind: "vulnerability"
aliases: ["CVE-2026-120228"]
title: "WAVLINK WN553X1-B router: remote command injection via group_id parameter"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN553X1-B", "fixed": [], "affected": "V260403_2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-likely-required", "home-router", "infrastructure", "iot", "wavlink", "wn553x1-b"]
not_affected_if: ["other-firmware-versions", "other-router-models"]
published_at: "2026-11-01T14:18:52+00:00"
first_seen_at: "2026-11-01T14:20:23+00:00"
updated_at: "2026-11-01T14:23:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120228", "first_seen_at": "2026-11-01T14:20:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T14:23:40+00:00"}]
---

# WAVLINK WN553X1-B router: remote command injection via group_id parameter

A WAVLINK WN553X1-B router firmware build (V260403_2.0.0) passes the group_id or group_name argument into an operating system command without proper checks. A remote attacker can run arbitrary commands on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN553X1-B affected V260403_2.0.0 fixed ?

## How to check

- Check the firmware version on the router admin page; V260403_2.0.0 is the only version reported vulnerable. Other versions are untested, not cleared.
- Check that the router admin interface is not exposed to the internet (WAN/remote management off).

## Timeline

- 2026-11-01T14:20:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120228
- 2026-11-01T14:23:40+00:00 analyst — VulDB (third party) describes it; researcher submission titled 'Authenticated Command Injection', CVSS has PR:L, so a login is likely needed (not vendor-confirmed). Public PoC on GitHub per VulDB (link locked, not read). WAVLINK advisory index has no entry for WN553X1-B and no fix found; nothing verified.

## Documents

- [describes] VulDB VDB-429587: WAVLINK WN553X1-B ioos group_id/group_name command injection https://vuldb.com/vuln/429587
- [mentions] WAVLINK Security Advisory index (no entry for this CVE) https://docs.wavlink.xyz/Security_Advisory/

## From the sources

A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_