CVE-2026-120231 is an OS command injection flaw in the OpenVPN CLI Handler of the WAVLINK WN553X1-B. It can be triggered remotely, and a public exploit has been disclosed. The CNA, VulDB, rates it critical (CVSS 3.1: 9.9). NVD has not yet scored it.
What Is It
CVE-2026-120231 is an OS command injection vulnerability (CWE-77, CWE-78) in WAVLINK WN553X1-B firmware version V260403_2.0.0. The flaw is in the function sub_416568 of the /bin/ioos binary, which belongs to the OpenVPN CLI Handler component. Manipulating the file_id argument causes OS command injection. VulDB reported the issue, and NVD published it on November 1, 2026. Its NVD status is "Received," which means NVD has not yet analyzed or scored it.
Why It Matters
The attack can be launched remotely. The CNA's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes low attack complexity, low privileges required and no user interaction. It also shows a changed scope with high impact to confidentiality, integrity and availability. The CNA's CVSS 4.0 assessment scores it 8.6 (HIGH), with exploit maturity rated as Proof-of-Concept. The CVSS 2.0 score is 9.0. All of these scores come from the CNA, not from NVD.
The description says the exploit "has been publicly disclosed and may be utilized." A public write-up is listed in the references. However, none of the sources below report active exploitation in the wild, and the CNA rates exploit maturity only as Proof-of-Concept.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN553X1-B
- Affected version: V260403_2.0.0
- Component: OpenVPN CLI Handler (
/bin/ioos, functionsub_416568) - CPE:
cpe:2.3:a:wavlink:wn553x1-b:*:*:*:*:*:*:*:*
Patch Status
The sources below do not mention a patch, fixed firmware version or vendor advisory. The description says only that "the vendor was contacted early about this disclosure." Owners of the affected device should watch WAVLINK for firmware updates. They should also track the VulDB entries below for changes to remediation status.