Live › vulnerability › CVE-2026-120239
The WAVLINK WN553X1-B router firmware (V260403_2.0.0) has an OS command injection in its WireGuard CLI handler, reached through the file_id argument. A remote attacker can run operating system commands on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 18:21 UTC. All times on this page are UTC.
WAVLINK WN553X1-B routers running firmware V260403_2.0.0. The flaw is in the WireGuard CLI handler (/bin/ioos, function sub_419DA8): the file_id argument reaches an OS command. The CVSS vector indicates low privileges are required (a login); the sources do not say whether WireGuard must be enabled. Owners of other models or firmware versions are not named as affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN553X1-B | vendor | V260403_2.0.0 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120239")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.