{"id":"CVE-2026-120231","kind":"vulnerability","aliases":["CVE-2026-120231"],"related":[],"title":"WAVLINK WN553X1-B router: authenticated OS command injection as root via openvpn_cli file_id","description":"A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.","summary":"In WAVLINK WN553X1-B firmware V260403_2.0.0, the openvpn_cli handler (sub_416568 in /bin/ioos, which runs as root) puts the file_id request parameter into a shell command (uci show ovpnclient | grep ...) with only a space check. According to the researcher's report, a logged-in user can inject commands that run as root. A public proof of concept is referenced. No vendor advisory or fixed firmware was found.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN553X1-B","fixed":[],"affected":"V260403_2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","infrastructure","openvpn","router","wavlink","wn553x1-b"],"not_affected_if":["non-default-password","other-firmware-versions","other-models"],"how_to_check":"- Check the firmware version in the router's admin page: V260403_2.0.0 is the version named in the report.\n- Check whether the admin web interface (ports 80/443) is reachable from the internet or from untrusted networks.\n- Check whether the admin password is still the factory default ('admin'). The researcher says the login can be done with that, which removes the authentication barrier.\n- Also check other WN553X1-B handlers: the researcher says ovpn_file, wg_file and check_pwd have the same flaw.","fix":null,"status":"open","published_at":"2026-11-01T15:17:23+00:00","first_seen_at":"2026-11-01T15:20:34+00:00","triaged_at":"2026-11-01T15:22:22+00:00","updated_at":"2026-11-01T15:23:20+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-01T15:22:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN553X1-B router: remote OS command injection via file_id argument","impact":"high","summary":"The WAVLINK WN553X1-B router firmware (V260403_2.0.0) passes the file_id argument of its OpenVPN CLI handler to a shell without sanitising it. A remote attacker can inject operating system commands and run them on the device, and a public exploit has been disclosed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn553x1-b","router","openvpn"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs operating system commands on the router remotely","analyst_note":"Find the vendor advisory or firmware update for WN553X1-B and confirm whether the OpenVPN CLI handler is reachable without authentication.","how_to_check":"- Check the firmware version on the device's admin page against `V260403_2.0.0`\n- Look for the `/bin/ioos` binary and the OpenVPN CLI handler on the device if you have shell access\n- Confirm whether the router's admin interface is reachable from the internet","plain_action":"","needs_analyst":true,"not_affected_if":["other-models","other-firmware-versions"],"who_is_affected":"Only WAVLINK WN553X1-B routers running firmware V260403_2.0.0 are named in the sources, and the flaw is in the OpenVPN CLI handler at /bin/ioos. The sources do not say whether other firmware versions or configurations are affected. Teams that do not run this model can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000719,"input_tokens":4162,"output_tokens":605,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the vendor advisory or firmware update for WN553X1-B and confirm whether the OpenVPN CLI handler is reachable without authentication.","search":"'-120231':19A,22A '-2026':18A,21A '/bin/ioos':51B,130C '2.0.0':43B,118C '416568':49B,126C 'accord':75B 'advisori':102B 'affect':120C 'argument':141C 'attack':154C 'auth':27B 'auth-requir':26B 'authent':6A 'b':4A,25A,35B,40B,116C 'caus':144C 'check':74B 'cli':14A,46B,135C 'command':8A,65B,88B,146C 'compon':133C 'concept':97B 'contact':169C 'cve':17A,20A 'determin':111C 'disclos':161C 'disclosur':173C 'earli':170C 'element':121C 'exploit':157C 'file':15A,58B,129C,142C 'firmwar':41B,105B 'fix':104B 'found':107B 'function':124C 'grep':69B 'handler':47B,136C 'id':16A,59B,143C 'infrastructur':29B 'initi':152C 'inject':9A,87B,147C 'log':83B 'logged-in':82B 'manipul':138C 'may':163C 'openvpn':13A,30B,45B,134C 'os':7A,145C 'ovpnclient':68B 'paramet':61B 'possibl':150C 'proof':95B 'public':94B,160C 'put':56B 'referenc':99B 'remot':155C 'report':80B 'request':60B 'requir':28B 'research':78B 'root':11A,55B,92B 'router':5A,31B 'run':53B,90B 'shell':64B 'show':67B 'space':73B 'sub':48B,125C 'uci':66B 'user':85B 'util':165C 'v260403':42B,117C 'vendor':101B,167C 'via':12A 'vulner':109C 'wavlink':1A,32B,37B,113C 'wn553x1':3A,24A,34B,39B,115C 'wn553x1-b':2A,23A,33B,38B,114C","nicknames":[],"mitigations":[],"who_affected":"Only WAVLINK WN553X1-B routers running firmware V260403_2.0.0 are named in the sources, and the flaw is in the OpenVPN CLI handler at /bin/ioos. The sources do not say whether other firmware versions or configurations are affected. Teams that do not run this model can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T15:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120231","severity":null,"published_at":"2026-11-01T15:17:23+00:00","modified_at":"2026-11-01T15:17:23+00:00","first_seen_at":"2026-11-01T15:20:34+00:00","fetched_at":"2026-11-01T15:20:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120231:1305","url":null,"severity":null,"published_at":"2026-11-01T15:23:20+00:00","modified_at":"2026-11-01T15:23:20+00:00","first_seen_at":"2026-11-01T15:23:20+00:00","fetched_at":"2026-11-01T15:23:20+00:00","note":"Only third-party sources: VulDB entry and researcher submit #919247 (authored by shuyi). No WAVLINK advisory or fix found. Researcher says exploitation needs a valid session token (opt=login), so it is authenticated; default password 'admin' makes it effectively unauthenticated on unchanged devices. Tested only in qemu emulation per report. PoC is on GitHub (link not shown on VulDB, so not saved). No exploitation in the wild known. Nothing marked verified, since there is no primary vendor page. Sibling CVEs 120228/120229/120238/120239 are the same product, not merges."}],"documents":[{"id":39478,"url":"https://vuldb.com/submit/919247","title":"VulDB Submit #919247: Wavlink WN553X1-B command injection (researcher report)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":39479,"url":"https://vuldb.com/vuln/429590","title":"VulDB VDB-429590 CVE-2026-120231","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}