Live › vulnerability › CVE-2026-120344
A WAVLINK WN551X3-A router firmware flaw lets remote users inject operating system commands through the group_name argument of its WireGuard CLI handler. An attacker who reaches the device can run commands on it, and a public exploit has been disclosed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 05:21 UTC. All times on this page are UTC.
Owners of WAVLINK WN551X3-A routers on firmware M51X3_V251020-WO-182e965 are affected. VulDB reports the flaw (the group_name argument of the WireGuard CLI handler in /bin/ioos) can be reached remotely without authentication, and a public proof of concept exists. Routers whose management interface is not reachable from untrusted networks are at lower risk; other firmware versions are unconfirmed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN551X3-A | vendor | M51X3_V251020-WO-182e965 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120344")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.