CVE-2026-120239 is a critical, remotely exploitable OS command injection flaw in the WireGuard CLI Handler of WAVLINK WN553X1-B firmware V260403_2.0.0, and a public exploit is available.
What Is It
The flaw is in the function sub_419DA8 in the /bin/ioos binary, part of the device's WireGuard CLI Handler component. An attacker can manipulate the file_id argument to inject operating system commands. The weakness is classified as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
VulDB, the CNA, scores it at CVSS 3.1 9.9 (CRITICAL) (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). VulDB also lists a CVSS 4.0 score of 8.6 (HIGH) and a CVSS 2.0 score of 9.0.
Why It Matters
- Remote attack: The attack can be carried out over the network, with low complexity and no user interaction.
- Low privileges required: The attacker needs low-level privileges (CVSS v2 lists single authentication) but nothing more.
- Scope change: The CVSS 3.1 scope is "Changed," with high confidentiality, integrity and availability impact. A successful attack can reach beyond the vulnerable component itself.
- Public exploit: The NVD description says the exploit "has been made public and could be used," and the CVSS 4.0 exploit maturity is Proof-of-Concept. A write-up is published on GitHub.
KEV status: This CVE has no CISA Known Exploited Vulnerabilities entry in the supplied data, so KEV does not confirm active exploitation in the wild at this time.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN553X1-B
- Affected version: V260403_2.0.0
- Component: WireGuard CLI Handler (
/bin/ioos, functionsub_419DA8) - CPE:
cpe:2.3:a:wavlink:wn553x1-b:*:*:*:*:*:*:*:*
The NVD record lists only V260403_2.0.0 as affected. The status of other firmware versions is not stated.
Patch Status
The source material does not mention a vendor patch or fixed firmware version. The NVD description says "the vendor was contacted early about this disclosure" but gives no response or fix. The NVD record status is "Received" (published 2026-11-01), so it has not been fully analyzed yet. With no KEV entry, there is also no CISA required action or due date.
If you run the WN553X1-B, check WAVLINK's channels for updated firmware. Restrict who can reach the device's management interfaces until a fix is confirmed.