{"id":"CVE-2026-120238","kind":"vulnerability","aliases":["CVE-2026-120238"],"related":[],"title":"WAVLINK WN553X1-B router: remote OS command injection via file_id argument","description":"A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","summary":"The WAVLINK WN553X1-B router firmware (260403_2.0.0) does not sanitize the file_id argument in its ovpn_file handler, so it passes attacker input to the operating system shell. A remote attacker can run arbitrary operating system commands on the device.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN553X1-B","fixed":[],"affected":"260403_2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["firmware","home-router","infrastructure","poc-public","router","wavlink","wn553x1-b"],"not_affected_if":["other-firmware-versions"],"how_to_check":"Router admin page > firmware/system info: if it shows WN553X1-B on 260403_2.0.0 (V260403_2.0.0), it is the affected build. No fixed version is published. Also check whether the web admin (ports 80/443) is reachable from the internet or from guest/untrusted networks.","fix":null,"status":"open","published_at":"2026-11-01T18:17:13+00:00","first_seen_at":"2026-11-01T18:21:31+00:00","triaged_at":"2026-11-01T18:23:37+00:00","updated_at":"2026-11-01T18:24:18+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-01T18:23:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN553X1-B router: remote OS command injection via file_id argument","impact":"high","summary":"The WAVLINK WN553X1-B router firmware (260403_2.0.0) does not sanitize the file_id argument in its ovpn_file handler, so it passes attacker input to the operating system shell. A remote attacker can run arbitrary operating system commands on the device.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn553x1-b","router","firmware","home-router"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary operating system commands on the router remotely","analyst_note":"Confirm the fixed firmware version and whether the admin interface must be exposed; check the vendor advisory and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120238.","how_to_check":"- Check the firmware version on the router's admin interface against `260403_2.0.0`\n- unknown","plain_action":"If you use a WAVLINK WN553X1-B router, check its firmware version and wait for WAVLINK to publish a fix before relying on it for remote access.","needs_analyst":true,"not_affected_if":["other-firmware-versions"],"who_is_affected":"Owners of WAVLINK WN553X1-B routers running firmware 260403_2.0.0, where the ovpn_file handler in /bin/ioos is reachable over the network. The sources do not say whether the flaw needs a logged-in session or a non-default feature. Devices not running this firmware are not named as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000726,"input_tokens":4155,"output_tokens":620,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed firmware version and whether the admin interface must be exposed; check the vendor advisory and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120238.","search":"'-120238':16A,19A '-2026':15A,18A '/bin/ioos':100C '2.0.0':44B,90C '260403':43B,89C '4162a8':96C 'affect':92C 'arbitrari':72B 'argument':13A,51B,111C 'attack':60B,69B,120C 'b':4A,22A,35B,40B,88C 'command':8A,75B,117C 'compon':103C 'contact':140C 'cve':14A,17A 'devic':78B 'disclos':129C 'disclosur':144C 'earli':141C 'execut':123C 'exploit':126C 'file':11A,49B,55B,99C,105C,112C 'firmwar':23B,42B 'found':83C 'function':94C 'handler':56B,106C 'home':25B 'home-rout':24B 'id':12A,50B,113C 'infrastructur':27B 'inject':9A,118C 'input':61B 'lead':114C 'manipul':108C 'may':134C 'oper':64B,73B 'os':7A,116C 'ovpn':54B,104C 'pass':59B 'poc':29B 'poc-publ':28B 'public':30B,132C 'remot':6A,68B,124C 'router':5A,26B,31B,41B 'run':71B 'sanit':47B 'shell':66B 'sub':95C 'system':65B,74B 'use':136C 'vendor':138C 'via':10A 'vulner':80C 'wavlink':1A,32B,37B,85C 'wn553x1':3A,21A,34B,39B,87C 'wn553x1-b':2A,20A,33B,38B,86C","nicknames":[],"mitigations":[],"who_affected":"Owners of WAVLINK WN553X1-B routers on firmware 260403_2.0.0. The flaw is in the ovpn_file handler of the /bin/ioos backend, which runs as root behind the web admin interface. The attack is remote and a public proof of concept exists. CVSS suggests a low-privileged login is needed, but VulDB does not say so directly. Other models and firmware versions are not named as affected. Anyone who can keep the admin interface off the internet and away from untrusted users is at much lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use a WAVLINK WN553X1-B router, check its firmware version and wait for WAVLINK to publish a fix before relying on it for remote access.","first_public_at":"2026-11-01T18:17:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120238","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120238","severity":null,"published_at":"2026-11-01T18:17:13+00:00","modified_at":"2026-11-01T18:17:13+00:00","first_seen_at":"2026-11-01T18:21:31+00:00","fetched_at":"2026-11-01T18:21:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120238:1315","url":null,"severity":null,"published_at":"2026-11-01T18:24:18+00:00","modified_at":"2026-11-01T18:24:18+00:00","first_seen_at":"2026-11-01T18:24:18+00:00","fetched_at":"2026-11-01T18:24:18+00:00","note":"Read VulDB VDB-429597 (CNA; reporter's GitHub advisory/PoC referenced, link not visible). WAVLINK's advisory index has no entry for this CVE, so no vendor fix or 'no fix' statement; VulDB says no countermeasures known. Fix status left unverified. CVSS vector has PR:L, so a login is probably needed; a sibling submission (#919251) describes authenticated injection in the same /bin/ioos. Not confirmed for this CVE. Nothing verified: no vendor page."}],"documents":[{"id":40177,"url":"https://vuldb.com/vuln/429597","title":"VulDB VDB-429597: WAVLINK WN553X1-B ovpn_file file_id os command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":39242,"url":"https://docs.wavlink.xyz/Security_Advisory/","title":"WAVLINK Security Advisory index (no WN553X1-B entry)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}