CVE-2026-120238 is a critical OS command injection flaw in the ovpn_file handler of WAVLINK WN553X1-B firmware 260403_2.0.0, and a public exploit has been disclosed.
What Is It
The flaw is in the function sub_4162A8 in the /bin/ioos binary, in the device's ovpn_file handler component. An attacker who manipulates the file_id argument can inject operating system commands. The attack can be carried out remotely.
VulDB, the CNA, classifies the weakness as CWE-77 (Command Injection) and CWE-78 (OS Command Injection). The NVD record was published on 2026-11-01 and its status is "Received."
Why It Matters
VulDB scores the flaw 9.9 (CRITICAL) under CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H):
- Network-reachable, with low attack complexity
- Low privileges required and no user interaction needed
- Scope changed, with high impact to confidentiality, integrity and availability
The CVSS v4.0 score is 8.6 (HIGH), with exploit maturity marked Proof-of-Concept. The CVSS v2.0 score is 9.0 and lists single authentication as a requirement.
According to the CVE description, "the exploit has been disclosed to the public and may be used." A public write-up is linked in the references. This CVE has no CISA KEV entry in the supplied data, so active exploitation in the wild is not confirmed by KEV at this time. Still, with a public exploit and network-reachable command injection, risk is high for exposed devices.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN553X1-B
- Affected version: 260403_2.0.0
- Component: ovpn_file Handler (
/bin/ioos, functionsub_4162A8) - Vulnerable parameter:
file_id - CPE:
cpe:2.3:a:wavlink:wn553x1-b:*:*:*:*:*:*:*:*
Patch Status
The supplied data contains no patch, fixed firmware version or vendor advisory. The description says only that "the vendor was contacted early about this disclosure." There is no CISA KEV required action or remediation due date because the CVE is not in the KEV catalog.
Owners of WN553X1-B devices running 260403_2.0.0 should check WAVLINK for updated firmware and follow the VulDB entry for remediation updates.