CVE-2026-120238: Command Injection

Published Nov 1, 2026

Updated

A vulnerability has been found in WAVLINK WN553X1-B 2604032.0.0. This affects the function sub4162A8 of the file /bin/ioos of the component ovpnfile Handler. Such manipulation of the argument fileid leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

Event History

Nov 1, 2026

CVE Published

via NVD·06:17 PM

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which devices are affected?

The affected product identified in the available information is WAVLINK WN553X1-B running firmware version 260403_2.0.0. The issue is in the ovpn_file handler within /bin/ioos.

What access does an attacker need to exploit this issue?

The vulnerability is remotely exploitable and has low attack complexity. However, the supplied vector indicates that the attacker needs low-level privileges before exploitation; no user interaction is required.

Is public exploit information available?

Yes. The exploit has been publicly disclosed and may be used by attackers.

What is the likely impact of successful exploitation?

Manipulation of the file_id argument can result in operating-system command injection. The provided severity vector indicates potential high impact to confidentiality, integrity, and availability, including subsequent systems.

CVE-2026-120238: Command Injection

Event History

Frequently Asked Questions

Which devices are affected?

What access does an attacker need to exploit this issue?

Is public exploit information available?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which devices are affected?

What access does an attacker need to exploit this issue?

Is public exploit information available?

What is the likely impact of successful exploitation?