Live › vulnerability › CVE-2026-120345
The WAVLINK WN551X3-A router firmware (M51X3_V251020-WO-182e965) has an OS command injection flaw in its DNS resolution handler, where the data argument is passed to a shell. A remote attacker can run operating system commands on the device without logging in, and a public exploit has been released.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 06:21 UTC. All times on this page are UTC.
Anyone running a WAVLINK WN551X3-A with firmware M51X3_V251020-WO-182e965. VulDB says no login is needed and the attack is remote, and a proof of concept is public. Owners of other WAVLINK models or firmware versions are not named in the sources; no vendor fix has been found.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN551X3-A | vendor | M51X3_V251020-WO-182e965 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120345")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.