WAVLINK WN553X1-B: OS command injection in OpenVPN CLI handler
Summary
The OpenVPN CLI handler (function sub_416568 in /bin/ioos) of the WAVLINK WN553X1-B router firmware V260403_2.0.0 passes the user-supplied parameter file_id unsanitized into a shell command. An attacker who can send requests to the device's web management interface can inject operating system commands, which run with root privileges and can lead to full compromise of the router. According to the public write-up, a valid session is required, and the factory-default admin password is known to be used on many devices. A public proof of concept exists.
Affected
- WAVLINK WN553X1-B, firmware V260403_2.0.0
- Other firmware versions: Unknown.
Fixed in
Unknown. No vendor fix or firmware update has been found at the time of writing.
Workaround
- No vendor workaround known.
- Disable the OpenVPN client feature if it is not needed.
- Do not expose the management interface to the WAN or create port forwards to it.
- Change the default admin password and restrict admin access to a management VLAN or specific IP addresses.
Exploitation
- A public proof-of-concept exploit is available in a third-party GitHub repository. It has not been reviewed.
- VulDB lists the exploit status as Proof-of-Concept.
- No evidence of exploitation in attacks has been found. CISA KEV status is unverified.
Our recommendation
- Check whether the router is reachable from the internet and whether the OpenVPN client feature is in use.
- Disable the OpenVPN client feature if it is not needed.
- Change default and weak admin passwords and restrict management access.
- Monitor for unexpected outbound connections and configuration changes on the device.
- Plan a replacement for devices where no vendor fix appears.
- Treat the severity as high to critical until NVD completes its analysis. The CVSS scores found differ (8.6, 9.4 and 9.9).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-120231 vuldb.com
- VulDB entry 429590 vuldb.com
- VulDB entry 429590 CTI vuldb.com
- OffSeq Radar CVE-2026-120231 radar.offseq.com
- Public write-up (third-party GitHub repository) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:20.
Original description (NVD)
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.