critical · CVSS v3 9.9 · CVSS v4 9.4

CVE-2026-120228

A critical OS command injection flaw exists in the ioos service of WAVLINK WN553X1-B routers. Remote attackers can manipulate group_id/group

Overview

A critical OS command injection flaw exists in the ioos service of WAVLINK WN553X1-B routers. Remote attackers can manipulate group_id/group_name arguments to execute arbitrary commands. The vulnerability can compromise device control and network security.

Description

A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

Impact

The flaw violates confidentiality by allowing attackers to read or modify device data, integrity by enabling unauthorized command execution, and availability by potentially disrupting router operation. Network administrators and end users of the affected routers are directly impacted.

Remediation

Apply the vendor-released firmware update (V260403_2.0.1 or later) that fixes the ioos service. If an update is unavailable, disable the ioos service or block remote access to the /bin/ioos endpoint via firewall rules. Monitor system logs for anomalous group_id/group_name activity.

Risk context

With a CVSS v3 score of 9.9 and critical severity, this vulnerability poses an immediate threat. Prompt patching is essential to mitigate the risk of remote exploitation.

Affected products

  • WAVLINK WN553X1-B

Scores

Severity
critical
CVSS v2
9
CVSS v3
9.9
CVSS v4
9.4
EPSS
—

os-command-injection remote-exploit router critical WAVLINK ioos-service firmware-patch

← All CVEs

Related CVEs

critical

CVE-2026-120279

A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

View analysis

critical

CVE-2026-120276

WAVLINK WN536AX6-A routers are vulnerable to remote OS command injection via the Web Management Interface. The flaw lies in the handling of the group_name parameter in /bin/ioos. Attackers can execute arbitrary commands on the device.

View analysis

critical

CVE-2026-120277

A critical OS command injection flaw exists in the WireGuard CLI Group Handler on WAVLINK WN536AX6-A routers, allowing remote attackers to execute arbitrary commands via the group_name argument. The vulnerability is publicly disclosed and can be exploited without authentication. It poses a severe risk to the confidentiality, integrity, and availability of affected devices.

View analysis

critical

CVE-2026-120280

A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

View analysis