CVE-2026-120239: Command Injection

Published Nov 1, 2026

Updated

A vulnerability was found in WAVLINK WN553X1-B V2604032.0.0. This vulnerability affects the function sub419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument fileid results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

Event History

Nov 1, 2026

CVE Published

via NVD·06:17 PM

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which systems are known to be affected?

The affected product identified is WAVLINK WN553X1-B running firmware V260403_2.0.0. The vulnerable code is the WireGuard CLI Handler in /bin/ioos.

Can this be exploited remotely, and is exploit code available?

The issue can be exploited remotely by manipulating the file_id argument processed by sub_419DA8. A public exploit has been disclosed and could be used.

CVE-2026-120239: Command Injection

Event History

Frequently Asked Questions

Which systems are known to be affected?

Can this be exploited remotely, and is exploit code available?

Company

Resources

Contact

Frequently Asked Questions

Which systems are known to be affected?

Can this be exploited remotely, and is exploit code available?