CVE-2026-120231: Command Injection

Published Nov 1, 2026

Updated

A vulnerability was determined in WAVLINK WN553X1-B V2604032.0.0. The affected element is the function sub416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument fileid causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

Event History

Nov 1, 2026

CVE Published

via NVD·03:17 PM

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are known to be affected?

The known affected product is the WAVLINK WN553X1-B running firmware V260403_2.0.0. The vulnerable functionality is the OpenVPN CLI Handler in /bin/ioos.

What level of access does an attacker need?

The CVSS vector indicates that exploitation is network-accessible, requires low privileges, and does not require user interaction. The vulnerable file_id argument can be manipulated to inject operating-system commands.

Is exploitation likely to be practical?

The attack complexity is rated low, and a public exploit disclosure is available. The vulnerability can affect confidentiality, integrity, and availability, including subsequent systems according to the supplied CVSS impact values.

CVE-2026-120231: Command Injection

Event History

Frequently Asked Questions

Which systems are known to be affected?

What level of access does an attacker need?

Is exploitation likely to be practical?

Company

Resources

Contact

Frequently Asked Questions

Which systems are known to be affected?

What level of access does an attacker need?

Is exploitation likely to be practical?