Threat level Severe
Contact
Critical 9.1
CVE-2026-120229

Wavlink WN553X1-B — command injection.

A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0.

WeaknessCWE-77: Command injectionCWE-78: Command injection
Published Source NVD
Read vendor advisoryView on NVD
CVSS 3.1
9.1
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Exploit chance, 30 days
Not scored yet
EPSS scores new CVEs within a day or two
Status
No known exploitation
Not in CISA KEV
Patch
Unknown
Check the vendor advisory

What happened

A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

What to do

  1. 01Check whether you run Wavlink WN553X1-B, and which version.
  2. 02Follow the vendor advisory for a fix or a workaround.

References

Timeline · UTC

  1. Published to NVD

Also actively exploited

CVE-2026-764188.6Cisco Secure Firewall ASA Software and Cisco Secure FTD SoftwareCVE-2026-1146259.9Arista VeloCloud OrchestratorCVE-2026-1114979.8Google Brotli
Vendor
Wavlink18 CVEs in 30 days
All Wavlink CVEs

Other CVEs in Wavlink WN553X1-B

5 more CVEs

All Wavlink WN553X1-B CVEs
9.9Wavlink WN553X1-B — command injection.9.9Wavlink WN553X1-B — command injection.9.9Wavlink WN553X1-B — command injection.9.9Wavlink WN553X1-B — command injection.9.9Wavlink WN553X1-B — command injection.