---
id: "CVE-2026-120238"
kind: "vulnerability"
aliases: ["CVE-2026-120238"]
title: "WAVLINK WN553X1-B router: remote OS command injection via file_id argument"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN553X1-B", "fixed": [], "affected": "260403_2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["firmware", "home-router", "infrastructure", "poc-public", "router", "wavlink", "wn553x1-b"]
not_affected_if: ["other-firmware-versions"]
published_at: "2026-11-01T18:17:13+00:00"
first_seen_at: "2026-11-01T18:21:31+00:00"
updated_at: "2026-11-01T18:24:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120238", "first_seen_at": "2026-11-01T18:21:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T18:24:18+00:00"}]
---

# WAVLINK WN553X1-B router: remote OS command injection via file_id argument

The WAVLINK WN553X1-B router firmware (260403_2.0.0) does not sanitize the file_id argument in its ovpn_file handler, so it passes attacker input to the operating system shell. A remote attacker can run arbitrary operating system commands on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN553X1-B affected 260403_2.0.0 fixed ?

## How to check

Router admin page > firmware/system info: if it shows WN553X1-B on 260403_2.0.0 (V260403_2.0.0), it is the affected build. No fixed version is published. Also check whether the web admin (ports 80/443) is reachable from the internet or from guest/untrusted networks.

## Timeline

- 2026-11-01T18:21:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120238
- 2026-11-01T18:24:18+00:00 analyst — Read VulDB VDB-429597 (CNA; reporter's GitHub advisory/PoC referenced, link not visible). WAVLINK's advisory index has no entry for this CVE, so no vendor fix or 'no fix' statement; VulDB says no countermeasures known. Fix status left unverified. CVSS vector has PR:L, so a login is probably needed; a sibling submission (#919251) describes authenticated injection in the same /bin/ioos. Not confirmed for this CVE. Nothing verified: no vendor page.

## Documents

- [advisory] VulDB VDB-429597: WAVLINK WN553X1-B ovpn_file file_id os command injection https://vuldb.com/vuln/429597
- [mentions] WAVLINK Security Advisory index (no WN553X1-B entry) https://docs.wavlink.xyz/Security_Advisory/

## From the sources

A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_