WAVLINK WN553X1-B: OS command injection in WireGuard CLI handler
Summary
The WireGuard CLI handler (function sub_419DA8 in /bin/ioos) of WAVLINK WN553X1-B routers with firmware V260403_2.0.0 passes the file_id parameter unsanitized to a shell command. An attacker can inject operating system commands that run with root privileges, which can lead to full compromise of the device. The researcher describes the attack as remote and authenticated, and states that the default admin password is sufficient to obtain a session. A public exploit exists, and no vendor fix is known.
Affected
- WAVLINK WN553X1-B router (researcher documentation names model WN553X3B)
- Firmware V260403_2.0.0
Fixed in
Unknown. No vendor advisory or patched firmware found.
Workaround
- Remove any WAN or internet access to the router's web and management interface.
- Disable remote administration and any VPN server functions that are not in use.
- Change the default admin password.
- Restrict access to management interfaces with strict firewall rules.
Exploitation
- Public exploit available according to VulDB.
- No evidence of active exploitation found; no CISA KEV listing.
Our recommendation
- Identify all WAVLINK WN553X1-B devices and check whether their management interface is reachable from the internet.
- Apply the workarounds above immediately, especially if default credentials are still in use.
- Monitor the WAVLINK support site for firmware newer than V260403_2.0.0 and install it as soon as it is available.
- Replace the device if no fix is released and it cannot be isolated.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-120239 at VulDB vuldb.com
- VulDB vulnerability 429598 vuldb.com
- Researcher write-up: WAVLINK WN553X1-B wireguard_cli command injection github.com
- Researcher write-up: WAVLINK WN553X1-B OpenVPN CLI command injection (same firmware) github.com
- VulDB CVE-2026-120229 (sibling CVE, generic mitigation advice) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:21.
Original description (NVD)
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.