---
id: "CVE-2026-120240"
kind: "vulnerability"
aliases: ["CVE-2026-120240"]
title: "WAVLINK WN553X1-B router: remote OS command injection via WireGuard group handler"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN553X1-B", "fixed": [], "affected": "V260403_2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "iot", "router", "wavlink", "wireguard", "wn553x1-b"]
not_affected_if: ["admin-not-exposed", "other-firmware-version"]
published_at: "2026-11-01T19:16:57+00:00"
first_seen_at: "2026-11-01T19:21:44+00:00"
updated_at: "2026-11-01T19:24:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120240", "first_seen_at": "2026-11-01T19:21:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T19:24:23+00:00"}]
---

# WAVLINK WN553X1-B router: remote OS command injection via WireGuard group handler

The WAVLINK WN553X1-B router firmware (V260403_2.0.0) passes the group_id or group_name argument of its WireGuard CLI group handler into an operating system command without proper checks. A remote attacker can use this to run arbitrary commands on the device, and the exploit has been publicly disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN553X1-B affected V260403_2.0.0 fixed ?

## How to check

- Open the router admin page and read the firmware version; V260403_2.0.0 is the only version named as affected.
- Check whether the web admin or remote management is reachable from the internet (WAN side) and whether WireGuard is configured.
- No fixed firmware is known: WAVLINK's advisory index (docs.wavlink.xyz/Security_Advisory/) has no entry for the WN553X1-B. Check it and WAVLINK support for new firmware, or write to security@wavlink.com.

## Fix

unknown: no fixed firmware published as of 2026-11-01; WAVLINK's advisory index has no entry for this model

## Timeline

- 2026-11-01T19:21:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120240
- 2026-11-01T19:24:23+00:00 analyst — Read VulDB entry (VDB-429599), NVD, and WAVLINK's advisory index. No vendor advisory or fixed firmware exists for WN553X1-B; the vendor index lists other models only. VulDB says the vendor was contacted early and no mitigation is known. A public PoC is on GitHub (linked only from VulDB, not read). The attack vector is network. The CVSS v4 vector shows PR:L, so a low-privilege login is probably needed, but I could not confirm that in a primary source. Nothing is marked verified.

## Documents

- [advisory] VulDB VDB-429599: WAVLINK WN553X1-B WireGuard CLI Group os command injection https://vuldb.com/vuln/429599
- [advisory] NVD CVE-2026-120240 https://nvd.nist.gov/vuln/detail/CVE-2026-120240
- [mentions] WAVLINK Security Advisory index (no WN553X1-B entry) https://docs.wavlink.xyz/Security_Advisory/

## From the sources

A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_