SECURITYCRITICALCVE-2026-120239

CVE-2026-120239: WAVLINK WN553X1-B WireGuard CLI Handler Command Injection

A CVSS 9.9 OS command injection in the WAVLINK WN553X1-B WireGuard CLI handler (sub_419DA8, file_id) is remotely exploitable; exploit details are public.

Dylan H.

Security Team

November 2, 2026
2 min read
CVE-2026-120239: WAVLINK WN553X1-B WireGuard CLI Handler Command Injection

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • WAVLINK WN553X1-B firmware V260403_2.0.0

CVE-2026-120239: WAVLINK WN553X1-B WireGuard CLI Handler

An OS command injection vulnerability was published on November 1, 2026 in the WAVLINK WN553X1-B (firmware V260403_2.0.0). Tracked as CVE-2026-120239 with a CVSS score of 9.9, it affects function sub_419DA8 of /bin/ioos, in the WireGuard CLI Handler.

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-120239
CVSS Score9.9 (Critical)
CWE ClassificationCWE-78 — OS Command Injection
Affected SoftwareWAVLINK WN553X1-B V260403_2.0.0
Vulnerable ComponentWireGuard CLI Handler, sub_419DA8 in /bin/ioos
Vulnerable Parameterfile_id
Attack VectorNetwork (remote)
PublishedNovember 1, 2026
ExploitationExploit disclosed publicly

Technical Description

Manipulating file_id results in OS command injection: attacker-controlled text reaches a shell invocation inside the WireGuard handling code. Related flaws in the same binary are CVE-2026-120231, CVE-2026-120238 and CVE-2026-120240.

Impact Assessment

Impact AreaDescription
ConfidentialityWireGuard private keys and peer configuration exposed
IntegrityTunnel and routing configuration can be altered
AvailabilityVPN and device disruption
Lateral MovementAccess to networks reachable over the tunnel

Remediation Guidance

  1. Check WAVLINK for fixed firmware; none was identified at publication.
  2. Keep the management interface off the internet and limit it to administrators.
  3. Rotate WireGuard keys if a device may have been exposed.
  4. Monitor for configuration changes and unexpected outbound connections.

Key Takeaways

  1. A fourth-in-series critical flaw hits the WN553X1-B ioos binary, this time in WireGuard handling
  2. Public exploit details raise the likelihood of scanning and abuse
  3. Rotate VPN keys on devices that may have been exposed

Sources