---
id: "CVE-2026-120344"
kind: "vulnerability"
aliases: ["CVE-2026-120344"]
title: "WAVLINK router: remote OS command injection via WireGuard group handler"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN551X3-A", "fixed": [], "affected": "M51X3_V251020-WO-182e965", "ecosystem": "vendor"}]
ecosystems: []
tags: ["home-router", "infrastructure", "self-hosted", "wavlink", "wireguard", "wn551x3-a"]
not_affected_if: ["default-config", "no-remote-access"]
published_at: "2026-11-02T05:18:25+00:00"
first_seen_at: "2026-11-02T05:21:35+00:00"
updated_at: "2026-11-02T05:24:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120344", "first_seen_at": "2026-11-02T05:21:35+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T05:24:47+00:00"}]
---

# WAVLINK router: remote OS command injection via WireGuard group handler

A WAVLINK WN551X3-A router firmware flaw lets remote users inject operating system commands through the group_name argument of its WireGuard CLI handler. An attacker who reaches the device can run commands on it, and a public exploit has been disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN551X3-A affected M51X3_V251020-WO-182e965 fixed ?

## How to check

- Check the router's firmware version in its admin page; M51X3_V251020-WO-182e965 is the reported vulnerable version. Other versions are unconfirmed.
- Check whether the web/management interface is reachable from the internet or untrusted networks.
- WAVLINK has not published a fix or advisory for this model as of 2026-11-02; check https://docs.wavlink.xyz/Security_Advisory/ for updates.

## Timeline

- 2026-11-02T05:21:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120344
- 2026-11-02T05:24:47+00:00 analyst — VulDB (secondary; links to a GitHub advisory/PoC I could not open) says no authentication needed, remote, PoC public, vendor contacted with no countermeasure known. WAVLINK's advisory index has no entry for WN551X3-A, so no vendor fix found; not verified. Sibling CVEs: CVE-2026-120345 (same device, DNS handler), CVE-2026-120277 (WN536AX6-A).

## Documents

- [describes] VulDB VDB-429669: WAVLINK WN551X3-A WireGuard CLI group_name OS command injection https://vuldb.com/vuln/429669
- [mentions] WAVLINK Security Advisory index (no entry for CVE-2026-120345) https://docs.wavlink.xyz/Security_Advisory/

## From the sources

A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_