On this page (7 sections)
A new vulnerability, CVE-2026-120228, has been published for the WAVLINK WN553X1-B router, firmware version V260403_2.0.0. According to the GitHub Advisory Database entry, a flaw in the ioos service allows OS command injection, it can be triggered remotely, and an exploit has been published.
If you run this router at an office, a shop, a branch site or a home office that hosts anything reachable from the internet, this is worth a few minutes of your time today. At the time of writing the records list no affected-version range beyond the one firmware build and no patched version, so the practical focus is on reducing exposure.
What was reported
The record describes a flaw in the function sub_416D88 of the file /bin/ioos, part of the ioos service. By manipulating the group_id or group_name argument, an attacker can inject operating system commands. The record states the attack can be executed remotely and that the vendor was contacted early about the disclosure.
The advisory entry is marked as unreviewed by GitHub, and the NVD page repeats the same description, so these are not two independent confirmations. The technical write-up referenced by the record is a third-party repository, and there is a VulDB entry. We have not seen a vendor advisory, so treat details such as affected builds as limited to what is listed.
Why command injection on a router matters
OS command injection happens when a program builds a system command from input it received and does not properly separate data from instructions. Whoever controls that input can make the device run commands of their choosing. On a router, which sits between your network and the internet, that can mean changed settings, traffic interception, a foothold for attacking other devices on the network, or the device being recruited into a botnet. Those outcomes are general consequences of this weakness class, not confirmed events for this CVE.
The CVSS v4 metrics in the advisory describe a network attack vector, low attack complexity, no attack requirements, no user interaction and low privileges required, with high impact on confidentiality, integrity and availability. In plain terms, an attacker needs some low-level access to the affected service, but does not need to trick anyone into clicking anything. The record does not explain what that low-level access is in practice.
Who is realistically exposed
- Anyone running a WAVLINK WN553X1-B on firmware V260403_2.0.0.
- Sites where the router's management interface or services are reachable from the internet, which raises the risk the most.
- Networks where untrusted users or devices share the LAN with the router, such as guest or shared office networks.
- Agencies and hosting administrators who manage routers for clients and may not have an inventory of the models in use.
The records do not say which interface or port the ioos service listens on, or whether it is reachable from the internet by default. Do not assume it is safe because you never enabled remote administration; check instead.
How to check your exposure
Start by confirming whether you have the affected model and firmware. Log in to the router's admin page from inside your network and look at the device model and firmware version on the status or system page. You are looking for WN553X1-B and V260403_2.0.0.
Then check what the router exposes to the internet. From a machine outside your network, you can use a scanner you are authorized to run against your own address. This command lists open ports on your public IP; replace the placeholder with your own address and only scan addresses you own. Look for management ports shown as open.
nmap -Pn YOUR.PUBLIC.IP.ADDRESSAny management ports shown as open are worth closing or restricting, whether or not they relate to this specific service. You can also review router and firewall logs for unexpected requests to the management interface or for unfamiliar outbound connections from the router.
What to do now
No fixed firmware is named in the research, so the steps below focus on limiting exposure and watching for vendor updates.
0 of 8 done
If you suspect the device was already tampered with, follow our guide on what to do when a website is hacked and rotate any credentials that passed through the router.
Detection and monitoring afterwards
Because a published exploit exists, assume scanning for this device model is possible. Watch for repeated requests to the router's management interface in logs, unexplained reboots, changed DNS settings and new outbound connections. For the sites behind the router, uptime, certificate and DNS monitoring can alert you to unexpected changes, though it cannot see inside the router itself. A free SSL certificate check is a quick way to confirm your public sites still present the certificate you expect.
What is still unknown
- Whether WAVLINK has released or planned a fixed firmware version.
- Whether other firmware versions or models are affected.
- Whether the flaw is being exploited in the wild; the record only says an exploit has been published and may be used.
- Which network interface and port the ioos service uses.
We will treat these as open until a vendor advisory or another independent source confirms them.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.