CVE-2026-120228 is a critical OS command injection flaw in the ioos service of WAVLINK WN553X1-B firmware V260403_2.0.0, and a public exploit has already been released.
What Is It
The flaw sits in the function sub_416D88 in the /bin/ioos binary, which belongs to the device's ioos Service component. An attacker can manipulate the group_id or group_name argument to inject operating system commands. The CNA (VulDB) classifies it as CWE-77 (Command Injection) and CWE-78 (OS Command Injection). The record says the attack can be carried out remotely.
Why It Matters
The CNA scores this CVSS 3.1 9.9 (CRITICAL) with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The attack works over the network, has low complexity, needs only low privileges, and requires no user interaction. The scope is changed, and impact on confidentiality, integrity, and availability is rated high. The CVSS 4.0 score is 8.6 (HIGH), with exploit maturity marked as Proof-of-Concept. CVSS 2.0 gives it 9.0.
The record states that "the exploit has been published and may be used." A third-party write-up of the flaw is also linked from the record (see Sources). The supplied data does not say how reliable the published exploit is.
This CVE is not in the CISA Known Exploited Vulnerabilities catalog, and the supplied data does not confirm active exploitation in the wild.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN553X1-B
- Affected version: V260403_2.0.0
- Component: ioos Service (
/bin/ioos, functionsub_416D88) - Vulnerable parameters:
group_id/group_name
The NVD record status is "Received," which means NVD has not yet completed its own analysis. The CPE listed by the CNA covers cpe:2.3:a:wavlink:wn553x1-b:*.
Patch Status
The supplied data lists no fixed firmware version or vendor advisory. The record says the vendor was contacted early about the disclosure but does not say whether they responded. Because there is no KEV entry, there is also no CISA-mandated remediation deadline.
Owners of WN553X1-B devices running V260403_2.0.0 should watch WAVLINK for a firmware update. Until one ships, they should limit network access to the device's management interfaces and the ioos service, and restrict who holds even low-privilege accounts, since the attack needs only low privileges.