WAVLINK WN553X1-B: OS command injection in ioos check_pwd handler
Summary
Firmware 260403_2.0.0 of the WAVLINK WN553X1-B router contains an OS command injection in function sub_416B50 of /bin/ioos. The unvalidated file_id parameter is inserted into a shell command, so an attacker can run arbitrary commands with root privileges on the device. According to the submitter's write-up, the attacker needs a valid session, which is easy to obtain on devices that still use the default admin password. A public exploit has been reported.
Affected
- WAVLINK WN553X1-B, firmware 260403_2.0.0 (written as V260403_2.0.0 in some sources)
Fixed in
Unknown. No fixed firmware version has been published.
Workaround
- No vendor workaround known.
- Remove internet exposure of the management interface and any VPN service.
- Change the default admin password.
- Restrict access to the device to trusted internal networks.
Exploitation
- Public proof of concept reported (VulDB, OffSeq rating: POC).
- Exploitation in the wild: Unknown. No reports found.
Our recommendation
- Inventory all WN553X1-B devices and record their firmware version.
- Remove WAN and VPN exposure now and change any default credentials.
- Check WAVLINK support for a fixed firmware and apply it when available.
- Replace the device if no fix is released.
- Monitor the device for unexpected outbound connections and configuration changes.
- Assess related CVEs for the same firmware together.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Submitter write-up (GitHub) github.com
- VulDB CVE-2026-120229 vuldb.com
- VulDB 429588 vuldb.com
- OffSeq Radar CVE-2026-120229 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:21.
Original description (NVD)
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.