CVE-2026-120344 is a remotely exploitable OS command injection flaw in the WireGuard CLI Group Handler of WAVLINK WN551X3-A firmware M51X3_V251020-WO-182e965, and a public exploit has been disclosed.
What Is It
The flaw is in the system function of /bin/ioos, inside the device's WireGuard CLI Group Handler component. Tampering with the group_name argument leads to OS command injection. The CNA (VulDB) classifies it as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
According to the record, the attack can be launched remotely. The exploit has been publicly disclosed and may be used. The record also says the vendor was contacted early about the disclosure.
Why It Matters
VulDB gives it a CVSS 3.1 base score of 10.0 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That means the attack runs over the network, needs low complexity, no privileges and no user interaction, and the scope is changed. Confidentiality, integrity and availability impacts are all high.
The CVSS 4.0 score is 9.3 (CRITICAL), with exploit maturity rated Proof-of-Concept. The CVSS 2.0 score is 10.0.
This CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation in the wild. However, a public proof-of-concept and an unauthenticated network attack path make it a high-priority exposure for anyone running the affected firmware.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN551X3-A
- Affected version: M51X3_V251020-WO-182e965
- Component: WireGuard CLI Group Handler (
/bin/ioos) - CPE:
cpe:2.3:a:wavlink:wn551x3-a:*:*:*:*:*:*:*:*
NVD lists the record as "Received," which means it has not been fully analyzed yet. The affected-version data comes from the CNA submission.
Patch Status
The supplied NVD and KEV data list no vendor patch, fixed firmware version or advisory. There is no CISA required action or due date because the CVE is not in the KEV catalog. Owners of affected devices should check WAVLINK's official channels for updated firmware. Until a fix is confirmed, they should limit network exposure of the device's management interfaces.