Live › vulnerability › CVE-2026-120238
The WAVLINK WN553X1-B router firmware (260403_2.0.0) does not sanitize the file_id argument in its ovpn_file handler, so it passes attacker input to the operating system shell. A remote attacker can run arbitrary operating system commands on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 18:21 UTC. All times on this page are UTC.
Owners of WAVLINK WN553X1-B routers on firmware 260403_2.0.0. The flaw is in the ovpn_file handler of the /bin/ioos backend, which runs as root behind the web admin interface. The attack is remote and a public proof of concept exists. CVSS suggests a low-privileged login is needed, but VulDB does not say so directly. Other models and firmware versions are not named as affected. Anyone who can keep the admin interface off the internet and away from untrusted users is at much lower risk.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN553X1-B | vendor | 260403_2.0.0 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120238")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.