CVE-2026-120240 is a critical OS command injection flaw in WAVLINK WN553X1-B firmware V260403_2.0.0, and a public exploit has been disclosed.
What Is It
The flaw is in the function sub_41A748 in the /bin/ioos binary, part of the device's WireGuard CLI Group Handler component. Tampering with the group_id or group_name argument can lead to OS command injection. The CNA (VulDB) classifies the weakness as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
NVD published the record on 2026-11-01. Its status is currently "Received," which means NVD has not yet analyzed it.
Why It Matters
- CVSS 3.1: 9.9 Critical (
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 8.6 High, with exploit maturity rated Proof-of-Concept
- CVSS 2.0: 9.0
The attack works remotely over the network. It needs low privileges and no user interaction. The CVSS 3.1 scope is "Changed," so the impact can reach beyond the vulnerable component. Confidentiality, integrity and availability impacts are all rated High.
The CNA says the exploit "has been publicly disclosed and may be utilized." A public write-up is available on GitHub.
This CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation in the wild.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN553X1-B
- Affected version: V260403_2.0.0
- Component: WireGuard CLI Group Handler (
/bin/ioos, functionsub_41A748) - CPE:
cpe:2.3:a:wavlink:wn553x1-b:*:*:*:*:*:*:*:*
The record lists only V260403_2.0.0 as affected. It does not say whether other firmware versions are affected.
Patch Status
The supplied records contain no patch, fixed firmware version, or vendor advisory. The CNA notes that the vendor was contacted early about this disclosure. It does not record a vendor response.
There is no KEV entry, so CISA has not set a required action or due date. Owners of WN553X1-B devices on V260403_2.0.0 should watch WAVLINK for a firmware update. Until one is available, they should treat the device as exposed.