{"id":"CVE-2026-120229","kind":"vulnerability","aliases":["CVE-2026-120229"],"related":[],"title":"WAVLINK WN553X1-B router: remote OS command injection via file_id argument","description":"A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","summary":"The WAVLINK WN553X1-B router firmware (260403_2.0.0) passes the file_id argument to an operating system command without sanitizing it. A remote attacker can inject shell commands and run them on the device.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN553X1-B","fixed":[],"affected":"260403_2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["command-injection","home-network","infrastructure","ioos","routers","wavlink","wn553x1-b"],"not_affected_if":["different-firmware-version","management-not-exposed"],"how_to_check":"Open the router admin page and check the firmware version; 260403_2.0.0 is the reported affected build (WN553X1-B). Make sure the admin interface (ports 80/443) is not reachable from the internet. Also check if you run other WAVLINK models, since several share the /bin/ioos backend.","fix":null,"status":"open","published_at":"2026-11-01T14:18:53+00:00","first_seen_at":"2026-11-01T14:20:23+00:00","triaged_at":"2026-11-01T14:22:12+00:00","updated_at":"2026-11-01T14:23:43+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-01T14:22:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN553X1-B router: remote OS command injection via file_id argument","impact":"high","summary":"The WAVLINK WN553X1-B router firmware (260403_2.0.0) passes the file_id argument to an operating system command without sanitizing it. A remote attacker can inject shell commands and run them on the device.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn553x1-b","routers","home-network"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary operating system commands on the router remotely","analyst_note":"Confirm whether a vendor firmware fix exists and whether authentication is required; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120229.","how_to_check":"- Check the firmware version on the router's admin interface; `260403_2.0.0` is the affected version.\n- Look for exposed management access from the internet to the device.","plain_action":"If you own a WAVLINK WN553X1-B router, check its firmware version and keep its admin page off the internet until the vendor publishes a fix.","needs_analyst":true,"not_affected_if":["different-firmware-version","management-not-exposed"],"who_is_affected":"Owners and operators of WAVLINK WN553X1-B routers running firmware 260403_2.0.0, where the vulnerable function in /bin/ioos is reachable over the network. Devices not running this firmware, or whose management interface is not reachable from untrusted networks, are less exposed. The sources do not state whether the flaw needs authentication.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000726,"input_tokens":4147,"output_tokens":623,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether a vendor firmware fix exists and whether authentication is required; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120229.","search":"'-120229':16A,19A '-2026':15A,18A '/bin/ioos':93C '2.0.0':44B,82C '260403':43B,81C '416b50':89C 'affect':85C 'argument':13A,49B,98C 'attack':60B,107C 'b':4A,22A,35B,40B,80C 'carri':112C 'command':8A,24B,54B,64B,104C 'command-inject':23B 'contact':130C 'cve':14A,17A 'devic':70B 'disclos':119C 'disclosur':134C 'earli':131C 'exploit':116C 'file':11A,47B,92C,99C 'firmwar':42B 'found':75C 'function':87C 'home':27B 'home-network':26B 'id':12A,48B,100C 'infrastructur':29B 'inject':9A,25B,62B,105C 'ioo':30B 'issu':84C 'lead':101C 'manipul':95C 'may':124C 'network':28B 'oper':52B 'os':7A,103C 'pass':45B 'possibl':109C 'public':122C 'remot':6A,59B,114C 'router':5A,31B,41B 'run':66B 'sanit':56B 'shell':63B 'sub':88C 'system':53B 'use':126C 'vendor':128C 'via':10A 'vulner':72C 'wavlink':1A,32B,37B,77C 'without':55B 'wn553x1':3A,21A,34B,39B,79C 'wn553x1-b':2A,20A,33B,38B,78C","nicknames":[],"mitigations":[],"who_affected":"Owners and operators of WAVLINK WN553X1-B routers running firmware 260403_2.0.0, where the vulnerable function in /bin/ioos is reachable over the network. Devices not running this firmware, or whose management interface is not reachable from untrusted networks, are less exposed. The sources do not state whether the flaw needs authentication.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Check that your WAVLINK router's remote (internet) administration is turned off, and install a firmware update from WAVLINK when one is released.","first_public_at":"2026-11-01T14:18:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120229","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120229","severity":null,"published_at":"2026-11-01T14:18:53+00:00","modified_at":"2026-11-01T14:18:53+00:00","first_seen_at":"2026-11-01T14:20:23+00:00","fetched_at":"2026-11-01T14:20:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120229:1302","url":null,"severity":null,"published_at":"2026-11-01T14:23:43+00:00","modified_at":"2026-11-01T14:23:43+00:00","first_seen_at":"2026-11-01T14:23:43+00:00","fetched_at":"2026-11-01T14:23:43+00:00","note":"No vendor advisory for this CVE on docs.wavlink.xyz (index checked); VulDB (secondary) says PoC public on GitHub, no countermeasure known, vendor contacted, 'additional authentication necessary' (auth requirement not confirmed by vendor; sibling WAVLINK ioos bugs differ, some bypass login via forged IP-FROM header). Fix unknown. Nothing marked verified. Not exploited per sources. Note: CVE-2026-120238/120239 are separate file_id bugs in the same binary."}],"documents":[{"id":39243,"url":"https://vuldb.com/vuln/429588","title":"VulDB VDB-429588: WAVLINK WN553X1-B sub_416B50 file_id os command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":39242,"url":"https://docs.wavlink.xyz/Security_Advisory/","title":"WAVLINK Security Advisory index (no entry for this CVE)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}