---
id: "CVE-2026-120231"
kind: "vulnerability"
aliases: ["CVE-2026-120231"]
title: "WAVLINK WN553X1-B router: authenticated OS command injection as root via openvpn_cli file_id"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN553X1-B", "fixed": [], "affected": "V260403_2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "infrastructure", "openvpn", "router", "wavlink", "wn553x1-b"]
not_affected_if: ["non-default-password", "other-firmware-versions", "other-models"]
published_at: "2026-11-01T15:17:23+00:00"
first_seen_at: "2026-11-01T15:20:34+00:00"
updated_at: "2026-11-01T15:23:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120231", "first_seen_at": "2026-11-01T15:20:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T15:23:20+00:00"}]
---

# WAVLINK WN553X1-B router: authenticated OS command injection as root via openvpn_cli file_id

In WAVLINK WN553X1-B firmware V260403_2.0.0, the openvpn_cli handler (sub_416568 in /bin/ioos, which runs as root) puts the file_id request parameter into a shell command (uci show ovpnclient | grep ...) with only a space check. According to the researcher's report, a logged-in user can inject commands that run as root. A public proof of concept is referenced. No vendor advisory or fixed firmware was found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN553X1-B affected V260403_2.0.0 fixed ?

## How to check

- Check the firmware version in the router's admin page: V260403_2.0.0 is the version named in the report.
- Check whether the admin web interface (ports 80/443) is reachable from the internet or from untrusted networks.
- Check whether the admin password is still the factory default ('admin'). The researcher says the login can be done with that, which removes the authentication barrier.
- Also check other WN553X1-B handlers: the researcher says ovpn_file, wg_file and check_pwd have the same flaw.

## Timeline

- 2026-11-01T15:20:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120231
- 2026-11-01T15:23:20+00:00 analyst — Only third-party sources: VulDB entry and researcher submit #919247 (authored by shuyi). No WAVLINK advisory or fix found. Researcher says exploitation needs a valid session token (opt=login), so it is authenticated; default password 'admin' makes it effectively unauthenticated on unchanged devices. Tested only in qemu emulation per report. PoC is on GitHub (link not shown on VulDB, so not saved). No exploitation in the wild known. Nothing marked verified, since there is no primary vendor page. Sibling CVEs 120228/120229/120238/120239 are the same product, not merges.

## Documents

- [describes] VulDB Submit #919247: Wavlink WN553X1-B command injection (researcher report) https://vuldb.com/submit/919247
- [mentions] VulDB VDB-429590 CVE-2026-120231 https://vuldb.com/vuln/429590

## From the sources

A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_