{"id":"CVE-2026-120345","kind":"vulnerability","aliases":["CVE-2026-120345"],"related":[],"title":"WAVLINK WN551X3-A router: remote OS command injection via DNS handler","description":"A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","summary":"The WAVLINK WN551X3-A router firmware (M51X3_V251020-WO-182e965) has an OS command injection flaw in its DNS resolution handler, where the data argument is passed to a shell. A remote attacker can run operating system commands on the device without logging in, and a public exploit has been released.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN551X3-A","fixed":[],"affected":"M51X3_V251020-WO-182e965","ecosystem":"vendor"}],"ecosystems":[],"tags":["firmware","home-router","infrastructure","router","wavlink","wn551x3-a"],"not_affected_if":["other-firmware-version","other-vendor"],"how_to_check":"- Check the firmware version in the router admin page against M51X3_V251020-WO-182e965 (the only version named as affected)\n- Check whether the admin/web interface is reachable from the internet; if so, disable remote management\n- Also check any other WAVLINK model using /bin/ioos: sibling CVEs exist for other models, but this CVE names only WN551X3-A","fix":null,"status":"open","published_at":"2026-11-02T06:17:43+00:00","first_seen_at":"2026-11-02T06:21:54+00:00","triaged_at":"2026-11-02T06:23:56+00:00","updated_at":"2026-11-02T06:25:29+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-02T06:23:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN551X3-A router: remote OS command injection via DNS handler","impact":"high","summary":"The WAVLINK WN551X3-A router firmware (M51X3_V251020-WO-182e965) has an OS command injection flaw in its DNS resolution handler, where the data argument is passed to a shell. A remote attacker can run operating system commands on the device without logging in, and a public exploit has been released.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn551x3-a","router","firmware","home-router"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs operating system commands on the router remotely","analyst_note":"Confirm whether the vendor has released a fixed firmware and whether the attack needs authentication; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120345.","how_to_check":"- Check the firmware version on the device admin page against `M51X3_V251020-WO-182e965`\n- Look for the DNS Resolution Handler component at `/bin/ioos` in the firmware image if you have it\n- Check whether the router's admin interface is reachable from the internet","plain_action":"If you own a WAVLINK WN551X3-A router, check its firmware version and watch for a vendor update, since no fix is stated yet.","needs_analyst":true,"not_affected_if":["other-firmware-version","other-vendor"],"who_is_affected":"Anyone running the WAVLINK WN551X3-A router with this firmware is exposed, and the flaw is reachable remotely. Teams using this router as edge or office network gear should treat it as exposed until a vendor fix is confirmed. Devices on other vendors or firmware versions are not named in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000755,"input_tokens":4164,"output_tokens":678,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the vendor has released a fixed firmware and whether the attack needs authentication; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-120345.","search":"'-120345':15A,18A '-2026':14A,17A '/bin/ioos':107C '182e965':42B,97C '41a430':103C 'a':21A 'argument':57B,119C 'attack':65B,132C 'command':8A,46B,70B,124C 'compon':110C 'contact':147C 'could':141C 'cve':13A,16A 'data':56B,120C 'devic':73B 'disclosur':151C 'dns':11A,51B,111C 'earli':148C 'exploit':80B,135C 'file':106C 'firmwar':22B,37B 'flaw':48B 'found':87C 'function':101C 'handler':12A,53B,113C 'home':24B 'home-rout':23B 'impact':99C 'infrastructur':26B 'initi':130C 'inject':9A,47B,125C 'log':75B 'm51x3':38B,93C 'made':138C 'manipul':116C 'oper':68B 'os':7A,45B,123C 'pass':59B 'perform':114C 'possibl':128C 'public':79B,139C 'releas':83B 'remot':6A,64B,133C 'resolut':52B,112C 'result':121C 'router':5A,25B,27B,36B 'run':67B 'shell':62B 'sub':102C 'system':69B 'use':143C 'v251020':40B,95C 'v251020-wo-182e965':39B,94C 'vendor':145C 'via':10A 'vulner':85C 'wavlink':1A,28B,32B,89C 'without':74B 'wn551x3':3A,20A,30B,34B,91C 'wn551x3-a':2A,19A,29B,33B,90C 'wo':41B,96C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a WAVLINK WN551X3-A with firmware M51X3_V251020-WO-182e965. VulDB says no login is needed and the attack is remote, and a proof of concept is public. Owners of other WAVLINK models or firmware versions are not named in the sources; no vendor fix has been found.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a WAVLINK WN551X3-A router, turn off remote access to its settings and check WAVLINK's site for a firmware update; none has been announced yet.","pkeys":["wn551x3a"],"ptokens":["wn551x3"],"labels":["critical","firmware","homerouter","infrastructure","router","wavlink","wn551x3a"],"first_public_at":"2026-11-02T06:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120345","severity":null,"published_at":"2026-11-02T06:17:43+00:00","modified_at":"2026-11-02T06:17:43+00:00","first_seen_at":"2026-11-02T06:21:54+00:00","fetched_at":"2026-11-02T06:21:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120345:1352","url":null,"severity":null,"published_at":"2026-11-02T06:25:29+00:00","modified_at":"2026-11-02T06:25:29+00:00","first_seen_at":"2026-11-02T06:25:29+00:00","fetched_at":"2026-11-02T06:25:29+00:00","note":"Read VulDB VDB-429670 (not the vendor's own page): no auth required, remote, public PoC on GitHub (link locked), no countermeasure known. WAVLINK's advisory index has no entry for this CVE, so no vendor fix or no-fix statement found; fix left unknown. Nothing marked verified. Sibling CVE-2026-120344 (WireGuard CLI, same firmware, /bin/ioos)."}],"documents":[{"id":50602,"url":"https://vuldb.com/vuln/429670","title":"VulDB VDB-429670: WAVLINK WN551X3-A DNS Resolution os command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":39242,"url":"https://docs.wavlink.xyz/Security_Advisory/","title":"WAVLINK Security Advisory index (no entry for CVE-2026-120345)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}