SECURITYCRITICALCVE-2026-120238

CVE-2026-120238: WAVLINK WN553X1-B ovpn_file Handler Command Injection

A CVSS 9.9 OS command injection in the WAVLINK WN553X1-B ovpn_file handler (sub_4162A8, file_id) is remotely exploitable and the exploit is disclosed.

Dylan H.

Security Team

November 2, 2026
2 min read
CVE-2026-120238: WAVLINK WN553X1-B ovpn_file Handler Command Injection

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • WAVLINK WN553X1-B firmware 260403_2.0.0

CVE-2026-120238: WAVLINK WN553X1-B ovpn_file Handler

An OS command injection vulnerability was published on November 1, 2026 in the WAVLINK WN553X1-B (firmware 260403_2.0.0). Tracked as CVE-2026-120238 with a CVSS score of 9.9, it affects function sub_4162A8 of /bin/ioos, in the ovpn_file handler.

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-120238
CVSS Score9.9 (Critical)
CWE ClassificationCWE-78 — OS Command Injection
Affected SoftwareWAVLINK WN553X1-B 260403_2.0.0
Vulnerable Componentovpn_file handler, sub_4162A8 in /bin/ioos
Vulnerable Parameterfile_id
Attack VectorNetwork (remote)
PublishedNovember 1, 2026
ExploitationExploit disclosed publicly

Technical Description

Manipulating the file_id argument leads to OS command injection; the value is incorporated into a shell command without neutralizing metacharacters. It is one of several similar flaws in the same binary, alongside CVE-2026-120231, CVE-2026-120239 and CVE-2026-120240.

Impact Assessment

Impact AreaDescription
ConfidentialityStored VPN profiles and credentials at risk
IntegrityDevice configuration can be modified
AvailabilityDevice disruption possible
Lateral MovementCompromised router exposes the internal network

Remediation Guidance

  1. Watch for a WAVLINK firmware update; none was identified at publication.
  2. Limit management interface access to trusted hosts and keep it off the internet.
  3. Segment affected routers from sensitive systems.
  4. Monitor for unexpected configuration changes and outbound traffic.

Key Takeaways

  1. WN553X1-B 260403_2.0.0 has another critical /bin/ioos command injection
  2. The exploit is public and no fix was confirmed
  3. Restrict access and segment until patched firmware ships

Sources