CVE-2026-120240: WAVLINK WN553X1-B WireGuard CLI Group Handler
An OS command injection vulnerability was published on November 1, 2026 in the WAVLINK WN553X1-B (firmware V260403_2.0.0). Tracked as CVE-2026-120240 with a CVSS score of 9.9, it affects function sub_41A748 of /bin/ioos, in the WireGuard CLI Group Handler.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-120240 |
| CVSS Score | 9.9 (Critical) |
| CWE Classification | CWE-78 — OS Command Injection |
| Affected Software | WAVLINK WN553X1-B V260403_2.0.0 |
| Vulnerable Component | WireGuard CLI Group Handler, sub_41A748 in /bin/ioos |
| Vulnerable Parameters | group_id / group_name |
| Attack Vector | Network (remote) |
| Published | November 1, 2026 |
| Exploitation | Exploit disclosed publicly |
Technical Description
Manipulating the group_id or group_name argument results in OS command injection, with values passed to a shell command unsanitized. Related flaws in the same binary are CVE-2026-120231, CVE-2026-120238 and CVE-2026-120239.
Impact Assessment
| Impact Area | Description |
|---|---|
| Confidentiality | VPN keys and device configuration exposed |
| Integrity | Router and tunnel settings can be modified |
| Availability | Device or VPN disruption |
| Lateral Movement | Foothold into networks behind the router |
Remediation Guidance
- Watch for WAVLINK firmware updates; no fix was identified at publication.
- Restrict and isolate the management interface; never expose it to the internet.
- Rotate WireGuard keys on devices that may have been reachable.
- Monitor for new processes, configuration drift and unusual outbound traffic.
Key Takeaways
- The WN553X1-B
ioosbinary now has at least four related critical command injection flaws - Exploit details are public and no patch was confirmed
- Treat these devices as untrusted until fixed firmware is available