Live › vulnerability › CVE-2026-120231
In WAVLINK WN553X1-B firmware V260403_2.0.0, the openvpn_cli handler (sub_416568 in /bin/ioos, which runs as root) puts the file_id request parameter into a shell command (uci show ovpnclient | grep ...) with only a space check. According to the researcher's report, a logged-in user can inject commands that run as root. A public proof of concept is referenced. No vendor advisory or fixed firmware was found.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 15:20 UTC. All times on this page are UTC.
Only WAVLINK WN553X1-B routers running firmware V260403_2.0.0 are named in the sources, and the flaw is in the OpenVPN CLI handler at /bin/ioos. The sources do not say whether other firmware versions or configurations are affected. Teams that do not run this model can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN553X1-B | vendor | V260403_2.0.0 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120231")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.