---
id: "CVE-2026-120229"
kind: "vulnerability"
aliases: ["CVE-2026-120229"]
title: "WAVLINK WN553X1-B router: remote OS command injection via file_id argument"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN553X1-B", "fixed": [], "affected": "260403_2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["command-injection", "home-network", "infrastructure", "ioos", "routers", "wavlink", "wn553x1-b"]
not_affected_if: ["different-firmware-version", "management-not-exposed"]
published_at: "2026-11-01T14:18:53+00:00"
first_seen_at: "2026-11-01T14:20:23+00:00"
updated_at: "2026-11-01T14:23:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120229", "first_seen_at": "2026-11-01T14:20:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T14:23:43+00:00"}]
---

# WAVLINK WN553X1-B router: remote OS command injection via file_id argument

The WAVLINK WN553X1-B router firmware (260403_2.0.0) passes the file_id argument to an operating system command without sanitizing it. A remote attacker can inject shell commands and run them on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN553X1-B affected 260403_2.0.0 fixed ?

## How to check

Open the router admin page and check the firmware version; 260403_2.0.0 is the reported affected build (WN553X1-B). Make sure the admin interface (ports 80/443) is not reachable from the internet. Also check if you run other WAVLINK models, since several share the /bin/ioos backend.

## Timeline

- 2026-11-01T14:20:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120229
- 2026-11-01T14:23:43+00:00 analyst — No vendor advisory for this CVE on docs.wavlink.xyz (index checked); VulDB (secondary) says PoC public on GitHub, no countermeasure known, vendor contacted, 'additional authentication necessary' (auth requirement not confirmed by vendor; sibling WAVLINK ioos bugs differ, some bypass login via forged IP-FROM header). Fix unknown. Nothing marked verified. Not exploited per sources. Note: CVE-2026-120238/120239 are separate file_id bugs in the same binary.

## Documents

- [describes] VulDB VDB-429588: WAVLINK WN553X1-B sub_416B50 file_id os command injection https://vuldb.com/vuln/429588
- [mentions] WAVLINK Security Advisory index (no entry for this CVE) https://docs.wavlink.xyz/Security_Advisory/

## From the sources

A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_