CVE-2026-120228: Command Injection

Published Nov 1, 2026

Updated

A flaw has been found in WAVLINK WN553X1-B V2604032.0.0. This vulnerability affects the function sub416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument groupid/groupname can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

Event History

Nov 1, 2026

CVE Published

via NVD·02:18 PM

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attack can be executed remotely and requires low privileges. No user interaction is required.

Which component and inputs are involved?

The issue affects the ioos Service, specifically the sub_416D88 function in /bin/ioos. Manipulation of the group_id or group_name argument can result in OS command injection.

Is exploitation likely to be practical?

An exploit has been published and may be used. This increases the likelihood that attackers can attempt exploitation against exposed affected devices.

CVE-2026-120228: Command Injection

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which component and inputs are involved?

Is exploitation likely to be practical?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which component and inputs are involved?

Is exploitation likely to be practical?