WAVLINK WN553X1-B: OS command injection in ioos service
Summary
WAVLINK WN553X1-B routers with firmware V260403_2.0.0 contain an OS command injection flaw in the ioos service (function sub_416D88). The group_id and group_name parameters of the openvpn_cli_group handler are passed unfiltered into shell commands. According to the published analysis, an attacker with a valid login can run arbitrary commands with root privileges, and a public exploit exists. No vendor advisory or fixed firmware is known yet.
Affected
- WAVLINK WN553X1-B (model WN553X3B), firmware V260403_2.0.0
Fixed in
Unknown. No fixed firmware version has been published.
Workaround
- No vendor countermeasure is known.
- Remove web admin access from the WAN side and from untrusted networks.
- Disable remote management.
- Change default and weak admin passwords.
- Place the router in a separate network segment.
Exploitation
- A public exploit is reported. VulDB states that an exploit is present.
- OffSeq rates exploit maturity as POC.
- No evidence of exploitation in the wild has been found. Unknown.
Our recommendation
- Check whether any WN553X1-B device is reachable from the internet or untrusted networks, and remove that exposure.
- Change the admin password and disable remote management.
- Plan replacement for devices if no fixed firmware is released.
- Watch the vendor firmware pages and CISA KEV for updates.
- Severity scores differ between sources (8.6 in the CVE data, 9.4 CVSS 4.0 and 9.9 CVSS 3.1 elsewhere). Treat it as high to critical until NVD publishes its analysis.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Public advisory (GitHub, IOT-CVE) github.com
- VulDB entry CVE-2026-120228 vuldb.com
- VulDB CVE page CVE-2026-120228 vuldb.com
- VulDB CTI entry vuldb.com
- WAVLINK product documentation docs.wavlink.xyz
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:20.
Original description (NVD)
A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.