---
id: "CVE-2026-120345"
kind: "vulnerability"
aliases: ["CVE-2026-120345"]
title: "WAVLINK WN551X3-A router: remote OS command injection via DNS handler"
severity: "critical"
cvss: 10.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN551X3-A", "fixed": [], "affected": "M51X3_V251020-WO-182e965", "ecosystem": "vendor"}]
ecosystems: []
tags: ["firmware", "home-router", "infrastructure", "router", "wavlink", "wn551x3-a"]
not_affected_if: ["other-firmware-version", "other-vendor"]
published_at: "2026-11-02T06:17:43+00:00"
first_seen_at: "2026-11-02T06:21:54+00:00"
updated_at: "2026-11-02T06:25:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120345", "first_seen_at": "2026-11-02T06:21:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T06:25:29+00:00"}]
---

# WAVLINK WN551X3-A router: remote OS command injection via DNS handler

The WAVLINK WN551X3-A router firmware (M51X3_V251020-WO-182e965) has an OS command injection flaw in its DNS resolution handler, where the data argument is passed to a shell. A remote attacker can run operating system commands on the device without logging in, and a public exploit has been released.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN551X3-A affected M51X3_V251020-WO-182e965 fixed ?

## How to check

- Check the firmware version in the router admin page against M51X3_V251020-WO-182e965 (the only version named as affected)
- Check whether the admin/web interface is reachable from the internet; if so, disable remote management
- Also check any other WAVLINK model using /bin/ioos: sibling CVEs exist for other models, but this CVE names only WN551X3-A

## Timeline

- 2026-11-02T06:21:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120345
- 2026-11-02T06:25:29+00:00 analyst — Read VulDB VDB-429670 (not the vendor's own page): no auth required, remote, public PoC on GitHub (link locked), no countermeasure known. WAVLINK's advisory index has no entry for this CVE, so no vendor fix or no-fix statement found; fix left unknown. Nothing marked verified. Sibling CVE-2026-120344 (WireGuard CLI, same firmware, /bin/ioos).

## Documents

- [describes] VulDB VDB-429670: WAVLINK WN551X3-A DNS Resolution os command injection https://vuldb.com/vuln/429670
- [mentions] WAVLINK Security Advisory index (no entry for CVE-2026-120345) https://docs.wavlink.xyz/Security_Advisory/

## From the sources

A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_