{"id":"CVE-2026-120240","kind":"vulnerability","aliases":["CVE-2026-120240"],"related":[],"title":"WAVLINK WN553X1-B router: remote OS command injection via WireGuard group handler","description":"A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.","summary":"The WAVLINK WN553X1-B router firmware (V260403_2.0.0) passes the group_id or group_name argument of its WireGuard CLI group handler into an operating system command without proper checks. A remote attacker can use this to run arbitrary commands on the device, and the exploit has been publicly disclosed.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN553X1-B","fixed":[],"affected":"V260403_2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","iot","router","wavlink","wireguard","wn553x1-b"],"not_affected_if":["admin-not-exposed","other-firmware-version"],"how_to_check":"- Open the router admin page and read the firmware version; V260403_2.0.0 is the only version named as affected.\n- Check whether the web admin or remote management is reachable from the internet (WAN side) and whether WireGuard is configured.\n- No fixed firmware is known: WAVLINK's advisory index (docs.wavlink.xyz/Security_Advisory/) has no entry for the WN553X1-B. Check it and WAVLINK support for new firmware, or write to security@wavlink.com.","fix":"unknown: no fixed firmware published as of 2026-11-01; WAVLINK's advisory index has no entry for this model","status":"open","published_at":"2026-11-01T19:16:57+00:00","first_seen_at":"2026-11-01T19:21:44+00:00","triaged_at":"2026-11-01T19:23:46+00:00","updated_at":"2026-11-01T19:24:23+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-01T19:23:46Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN553X1-B router: remote OS command injection via WireGuard group handler","impact":"high","summary":"The WAVLINK WN553X1-B router firmware (V260403_2.0.0) passes the group_id or group_name argument of its WireGuard CLI group handler into an operating system command without proper checks. A remote attacker can use this to run arbitrary commands on the device, and the exploit has been publicly disclosed.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn553x1-b","router","wireguard","iot"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote attacker runs arbitrary OS commands on the router","analyst_note":"Check the NVD entry and vendor channels for a fixed firmware version and whether authentication is required to reach the WireGuard group handler.","how_to_check":"- Check the firmware version on the device admin page; the sources name `V260403_2.0.0` as affected.\n- Look for the WireGuard group management feature and confirm whether it is exposed to the internet.\n- Check whether the vendor has published a newer firmware for the WN553X1-B.","plain_action":"If you own a WAVLINK WN553X1-B router, check its firmware version and watch for a vendor update, and keep its admin interface off the internet.","needs_analyst":true,"not_affected_if":["other-firmware-version","admin-not-exposed"],"who_is_affected":"Owners and operators of the WAVLINK WN553X1-B running firmware V260403_2.0.0 with the WireGuard group handler reachable over the network. The sources say the vendor was contacted early about this disclosure but do not state a fixed version. Devices where the admin interface is not reachable from outside the local network are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000756,"input_tokens":4169,"output_tokens":678,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and vendor channels for a fixed firmware version and whether authentication is required to reach the WireGuard group handler.","search":"'-120240':16A,19A '-2026':15A,18A '/bin/ioos':103C '2.0.0':39B,92C '41a748':99C 'affect':95C 'arbitrari':70B 'argument':47B,116C 'attack':64B,126C 'b':4A,22A,30B,35B,90C 'check':61B 'cli':51B,108C 'command':8A,58B,71B,123C 'compon':106C 'contact':145C 'cve':14A,17A 'determin':85C 'devic':74B 'disclos':81B,137C 'disclosur':149C 'earli':146C 'execut':111C 'exploit':77B,133C 'file':102C 'firmwar':37B 'function':97C 'group':12A,42B,45B,52B,109C,117C 'handler':13A,53B,110C 'id':43B 'id/group_name':118C 'infrastructur':23B 'inject':9A,124C 'iot':24B 'issu':94C 'lead':120C 'manipul':113C 'may':127C,139C 'name':46B 'oper':56B 'os':7A,122C 'pass':40B 'perform':129C 'proper':60B 'public':80B,136C 'remot':6A,63B,131C 'router':5A,25B,36B 'run':69B 'sub':98C 'system':57B 'use':66B 'util':141C 'v260403':38B,91C 'vendor':143C 'via':10A 'vulner':83C 'wavlink':1A,26B,32B,87C 'wireguard':11A,27B,50B,107C 'without':59B 'wn553x1':3A,21A,29B,34B,89C 'wn553x1-b':2A,20A,28B,33B,88C","nicknames":[],"mitigations":[],"who_affected":"WAVLINK WN553X1-B routers running firmware V260403_2.0.0. The flaw is in the WireGuard CLI group handler (/bin/ioos, sub_41A748), where group_id/group_name reach an OS command. CVSS v4 vector suggests low privileges are needed (PR:L), so a login is likely required, but the sources don't say. Other firmware versions and other WAVLINK models are not listed as affected. Units with the admin interface not reachable from the internet are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a WAVLINK WN553X1-B router, turn off remote access to its admin page and check WAVLINK's support site for a firmware update.","first_public_at":"2026-11-01T19:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120240","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120240","severity":null,"published_at":"2026-11-01T19:16:57+00:00","modified_at":"2026-11-01T19:16:57+00:00","first_seen_at":"2026-11-01T19:21:44+00:00","fetched_at":"2026-11-01T19:21:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120240:1317","url":null,"severity":null,"published_at":"2026-11-01T19:24:23+00:00","modified_at":"2026-11-01T19:24:23+00:00","first_seen_at":"2026-11-01T19:24:23+00:00","fetched_at":"2026-11-01T19:24:23+00:00","note":"Read VulDB entry (VDB-429599), NVD, and WAVLINK's advisory index. No vendor advisory or fixed firmware exists for WN553X1-B; the vendor index lists other models only. VulDB says the vendor was contacted early and no mitigation is known. A public PoC is on GitHub (linked only from VulDB, not read). The attack vector is network. The CVSS v4 vector shows PR:L, so a low-privilege login is probably needed, but I could not confirm that in a primary source. Nothing is marked verified."}],"documents":[{"id":40402,"url":"https://vuldb.com/vuln/429599","title":"VulDB VDB-429599: WAVLINK WN553X1-B WireGuard CLI Group os command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":39242,"url":"https://docs.wavlink.xyz/Security_Advisory/","title":"WAVLINK Security Advisory index (no WN553X1-B entry)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":40404,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120240","title":"NVD CVE-2026-120240","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}