SECURITYCRITICALCVE-2026-120231

CVE-2026-120231: WAVLINK WN553X1-B OpenVPN Handler Command Injection

A CVSS 9.9 OS command injection in the WAVLINK WN553X1-B OpenVPN CLI handler (sub_416568, file_id) is remotely exploitable with a public exploit.

Dylan H.

Security Team

November 2, 2026
2 min read
CVE-2026-120231: WAVLINK WN553X1-B OpenVPN Handler Command Injection

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • WAVLINK WN553X1-B firmware V260403_2.0.0

CVE-2026-120231: WAVLINK WN553X1-B OpenVPN CLI Handler

An OS command injection vulnerability was published on November 1, 2026 in the WAVLINK WN553X1-B (firmware V260403_2.0.0). Tracked as CVE-2026-120231, the flaw is in function sub_416568 of /bin/ioos, in the OpenVPN CLI Handler. Some trackers score it 9.9 (Critical); SecurityFocus lists 8.6 (High).

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-120231
CVSS Score9.9 (Critical) per NVD-fed trackers; 8.6 per SecurityFocus
CWE ClassificationCWE-78 — OS Command Injection
Affected SoftwareWAVLINK WN553X1-B V260403_2.0.0
Vulnerable ComponentOpenVPN CLI Handler, sub_416568 in /bin/ioos
Vulnerable Parameterfile_id
Attack VectorNetwork (remote)
PublishedNovember 1, 2026
ExploitationExploit publicly disclosed per VulDB; not in CISA KEV

Technical Description

Manipulating the file_id argument causes the handler to pass attacker-controlled text into a shell command. Shell metacharacters in the value execute with the privileges of the ioos process. Sibling flaws in the same binary (the ovpn_file handler, the WireGuard CLI handlers) are tracked as CVE-2026-120238, CVE-2026-120239 and CVE-2026-120240.

Impact Assessment

Impact AreaDescription
ConfidentialityVPN keys, configs and Wi-Fi credentials exposed
IntegrityRouter configuration and routing can be tampered with
AvailabilityDevice disruption
Lateral MovementFoothold in the network behind the VPN/router

Remediation Guidance

  1. No vendor fix was identified at publication; check WAVLINK for firmware newer than V260403_2.0.0.
  2. Restrict management access to a trusted network and never expose it to the internet.
  3. Disable unused VPN features where possible.
  4. Monitor for unexpected processes, configuration changes and outbound connections.

Key Takeaways

  1. WN553X1-B V260403_2.0.0 has multiple /bin/ioos command injection flaws
  2. Exploit details are public and no patch was confirmed
  3. Isolate and restrict these devices until fixed firmware exists

Sources