A remotely reachable OS command injection flaw in WAVLINK WN553X1-B firmware 260403_2.0.0 has a publicly disclosed exploit and a CVSS 3.1 score of 9.1 (Critical).
What Is It
CVE-2026-120229 is an OS command injection vulnerability (CWE-77, CWE-78) in the WAVLINK WN553X1-B. The flaw is in the function sub_416B50 of the /bin/ioos binary. Manipulating the file_id argument lets an attacker inject operating system commands, and the attack can be carried out remotely.
VulDB, the CNA, assigned the CVE. NVD published it on 2026-11-01, and its status is still "Received," so NVD has not yet completed its own analysis.
The CVE record links to a researcher write-up on GitHub. That write-up's filename refers to a check_pwd command injection in the WN553X1-B, not to sub_416B50 or the file_id parameter. The supplied data does not confirm that the write-up covers the flaw described in this CVE.
Why It Matters
The vendor-neutral scoring describes a serious issue:
- CVSS 3.1: 9.1 Critical (
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). The attack is network-based, has low complexity and needs no user interaction. Scope is changed, and confidentiality, integrity and availability impacts are all high. - CVSS 4.0: 8.5 High, with exploit maturity rated Proof-of-Concept.
- CVSS 2.0: 8.3 High.
Exploitation requires high privileges, which means the attacker most likely needs authenticated administrative access first. That limits exposure somewhat. Still, the advisory says the exploit "has been disclosed to the public and may be used," so the barrier for a capable attacker is low once they have credentials.
Exploitation status: None of the sources cited here say whether this CVE is in CISA's Known Exploited Vulnerabilities catalog, and they do not confirm active exploitation in the wild.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN553X1-B
- Affected version: 260403_2.0.0
- Component:
/bin/ioos, functionsub_416B50, parameterfile_id
The source data does not say whether other firmware versions are affected.
Patch Status
The supplied records list no vendor patch, fixed firmware version or vendor advisory. The CNA says WAVLINK "was contacted early about this disclosure," but there is no record of a vendor response.
Until WAVLINK publishes a fix, owners of affected devices should keep checking for firmware updates. Because exploitation needs high privileges, they should also restrict who can reach the management interface and who holds administrative credentials.