Live › vulnerability › CVE-2026-120229
The WAVLINK WN553X1-B router firmware (260403_2.0.0) passes the file_id argument to an operating system command without sanitizing it. A remote attacker can inject shell commands and run them on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 14:20 UTC. All times on this page are UTC.
Owners and operators of WAVLINK WN553X1-B routers running firmware 260403_2.0.0, where the vulnerable function in /bin/ioos is reachable over the network. Devices not running this firmware, or whose management interface is not reachable from untrusted networks, are less exposed. The sources do not state whether the flaw needs authentication.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN553X1-B | vendor | 260403_2.0.0 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120229")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.