{"id":"CVE-2026-120344","kind":"vulnerability","aliases":["CVE-2026-120344"],"related":[],"title":"WAVLINK router: remote OS command injection via WireGuard group handler","description":"A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","summary":"A WAVLINK WN551X3-A router firmware flaw lets remote users inject operating system commands through the group_name argument of its WireGuard CLI handler. An attacker who reaches the device can run commands on it, and a public exploit has been disclosed.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN551X3-A","fixed":[],"affected":"M51X3_V251020-WO-182e965","ecosystem":"vendor"}],"ecosystems":[],"tags":["home-router","infrastructure","self-hosted","wavlink","wireguard","wn551x3-a"],"not_affected_if":["default-config","no-remote-access"],"how_to_check":"- Check the router's firmware version in its admin page; M51X3_V251020-WO-182e965 is the reported vulnerable version. Other versions are unconfirmed.\n- Check whether the web/management interface is reachable from the internet or untrusted networks.\n- WAVLINK has not published a fix or advisory for this model as of 2026-11-02; check https://docs.wavlink.xyz/Security_Advisory/ for updates.","fix":null,"status":"open","published_at":"2026-11-02T05:18:25+00:00","first_seen_at":"2026-11-02T05:21:35+00:00","triaged_at":"2026-11-02T05:23:32+00:00","updated_at":"2026-11-02T05:24:47+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-02T05:23:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK router: remote OS command injection via WireGuard group handler","impact":"high","summary":"A WAVLINK WN551X3-A router firmware flaw lets remote users inject operating system commands through the group_name argument of its WireGuard CLI handler. An attacker who reaches the device can run commands on it, and a public exploit has been disclosed.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn551x3-a","wireguard","home-router","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs operating system commands on the router remotely","analyst_note":"Confirm whether a vendor firmware fix exists and whether authentication is required to reach the group_name argument, using the NVD entry and vendor advisory.","how_to_check":"- Check the firmware version on the device against `M51X3_V251020-WO-182e965`\n- Check whether the WireGuard feature is enabled on the router\n- Check whether the router's management interface is reachable from the internet","plain_action":"If you use a WAVLINK WN551X3-A router, check with the manufacturer for a firmware update and turn off remote access to it until one is installed.","needs_analyst":true,"not_affected_if":["default-config","no-remote-access"],"who_is_affected":"Owners of WAVLINK WN551X3-A routers running firmware M51X3_V251020-WO-182e965 with the WireGuard feature in use are exposed, as the flaw is in the WireGuard CLI group handler at /bin/ioos. Devices whose management interface is not reachable from the internet are at lower risk, but the sources do not say which configurations are affected beyond this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000741,"input_tokens":4164,"output_tokens":650,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether a vendor firmware fix exists and whether authentication is required to reach the group_name argument, using the NVD entry and vendor advisory.","search":"'-120344':13A,16A '-2026':12A,15A '/bin/ioos':97C '182e965':88C 'a':19A 'affect':90C 'argument':50B,109C 'attack':57B,118C 'cli':54B,102C 'command':5A,45B,64B,115C 'compon':100C 'contact':139C 'cve':11A,14A 'devic':61B 'disclos':73B,128C 'disclosur':143C 'earli':140C 'exploit':70B,125C 'file':96C 'firmwar':37B 'flaw':38B 'found':78C 'function':92C 'group':9A,48B,103C,110C 'handler':10A,55B,104C 'home':21B 'home-rout':20B 'host':26B 'infrastructur':23B 'inject':6A,42B,116C 'lead':112C 'let':39B 'm51x3':84C 'manipul':106C 'may':119C,133C 'name':49B,111C 'oper':43B 'os':4A,114C 'perform':121C 'public':69B,131C 'reach':59B 'remot':3A,40B,123C 'router':2A,22B,36B 'run':63B 'self':25B 'self-host':24B 'system':44B,93C 'use':135C 'user':41B 'v251020':86C 'v251020-wo-182e965':85C 'vendor':137C 'via':7A 'vulner':75C 'wavlink':1A,27B,32B,80C 'wireguard':8A,28B,53B,101C 'wn551x3':18A,30B,34B,82C 'wn551x3-a':17A,29B,33B,81C 'wo':87C","nicknames":[],"mitigations":[],"who_affected":"Owners of WAVLINK WN551X3-A routers on firmware M51X3_V251020-WO-182e965 are affected. VulDB reports the flaw (the group_name argument of the WireGuard CLI handler in /bin/ioos) can be reached remotely without authentication, and a public proof of concept exists. Routers whose management interface is not reachable from untrusted networks are at lower risk; other firmware versions are unconfirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you use a WAVLINK WN551X3-A router, check with the manufacturer for a firmware update and turn off remote access to it until one is installed.","pkeys":["wn551x3a"],"ptokens":["wn551x3"],"labels":["critical","homerouter","infrastructure","selfhosted","wavlink","wireguard","wn551x3a"],"first_public_at":"2026-11-02T05:18:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120344","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120344","severity":null,"published_at":"2026-11-02T05:18:25+00:00","modified_at":"2026-11-02T05:18:25+00:00","first_seen_at":"2026-11-02T05:21:35+00:00","fetched_at":"2026-11-02T05:21:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120344:1347","url":null,"severity":null,"published_at":"2026-11-02T05:24:47+00:00","modified_at":"2026-11-02T05:24:47+00:00","first_seen_at":"2026-11-02T05:24:47+00:00","fetched_at":"2026-11-02T05:24:47+00:00","note":"VulDB (secondary; links to a GitHub advisory/PoC I could not open) says no authentication needed, remote, PoC public, vendor contacted with no countermeasure known. WAVLINK's advisory index has no entry for WN551X3-A, so no vendor fix found; not verified. Sibling CVEs: CVE-2026-120345 (same device, DNS handler), CVE-2026-120277 (WN536AX6-A)."}],"documents":[{"id":50399,"url":"https://vuldb.com/vuln/429669","title":"VulDB VDB-429669: WAVLINK WN551X3-A WireGuard CLI group_name OS command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":39242,"url":"https://docs.wavlink.xyz/Security_Advisory/","title":"WAVLINK Security Advisory index (no entry for CVE-2026-120345)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}