CVE-2026-120345 is a critical OS command injection flaw in the DNS Resolution Handler of WAVLINK WN551X3-A firmware. It has a CVSS 3.1 score of 10.0, and a public exploit is available.
What Is It
The flaw is in the function sub_41a430 of the /bin/ioos binary, which is part of the device's DNS Resolution Handler component. An attacker can manipulate the data argument to inject operating system commands. VulDB, the CNA, says the attack can be launched remotely.
The CNA maps the weakness to CWE-77 (Command Injection) and CWE-78 (OS Command Injection). The record was published on 2026-11-02. NVD lists its status as "Received," which means NVD has not finished its own analysis yet.
Why It Matters
VulDB rates the flaw as critical on every severity scale it supplied. The CVSS 3.1 and CVSS 2.0 scores are both the maximum of 10.0, and the CVSS 4.0 score is 9.3:
- CVSS 3.1: 10.0 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It is reachable over the network, needs no privileges or user interaction, has low attack complexity, and has a changed scope. - CVSS 4.0: 9.3 CRITICAL. Exploit maturity is rated Proof-of-Concept, with high impact on both the vulnerable system and subsequent systems.
- CVSS 2.0: 10.0, with complete loss of confidentiality, integrity and availability.
According to the CNA, the exploit "has been made public and could be used." A public write-up is linked in the references. A successful attack could let an unauthenticated attacker run commands on the router, which sits at the network edge.
This CVE has no entry in the CISA Known Exploited Vulnerabilities (KEV) catalog, so CISA has not confirmed active exploitation. Because a public proof-of-concept exists, the risk of exploitation is still high.
What's Vulnerable
- Vendor: WAVLINK
- Product: WN551X3-A
- Affected version: M51X3_V251020-WO-182e965
- Component: DNS Resolution Handler (
/bin/ioos, functionsub_41a430) - CPE:
cpe:2.3:a:wavlink:wn551x3-a:*:*:*:*:*:*:*:*
The supplied data does not list any other versions as affected or fixed.
Patch Status
The source material does not mention a vendor patch, a fixed firmware version or official mitigation guidance. The CNA says the vendor was contacted early about the disclosure but does not record a vendor response.
Since this CVE is not in KEV, there is no CISA required action or due date. Owners of affected WN551X3-A devices should watch WAVLINK and VulDB for updated firmware or advisories.