On this page (8 sections)
CVE-2026-120229 is an OS command injection flaw in the WAVLINK WN553X1-B, version 260403_2.0.0. According to the GitHub Advisory Database entry, the problem sits in a function called sub_416B50 in the file /bin/ioos, and it can be reached remotely. The advisory also says an exploit has been disclosed publicly and may be used.
If you run this device at an office, a shop, a client site or a hosting location, this is worth a few minutes of attention. No patched version is listed in the sources we have, so the practical focus today is limiting who can reach the device's management functions.
What was reported
The advisory text says the manipulation of the argument file_id leads to OS command injection in the function sub_416B50 of /bin/ioos. It states the attack can be carried out remotely, that the exploit has been disclosed to the public, and that the vendor was contacted early about the disclosure. The NVD record carries the same text, so it is the same report rather than separate confirmation.
The GitHub entry is marked unreviewed, and only one independent publisher covers the story so far. Treat the details as a single-source report. The advisory references a public write-up on GitHub and entries on VulDB. We do not reproduce exploit details here.
What command injection means
Command injection happens when a device builds an operating system command from input it receives and does not properly separate that input from the command itself. An attacker who controls the input, here the file_id argument, can make the device run commands it was never meant to run. On a router or access point, those commands usually run with very high privileges, which is why the impact ratings are severe.
How serious is it
The CVSS v4 metrics in the advisory give a score of 8.5. They describe a network attack vector, low attack complexity, no attack requirements and no user interaction, with high impact on confidentiality, integrity and availability, for both the vulnerable system and subsequent systems.
One metric lowers the urgency a little: privileges required is rated High. That suggests an attacker would need some form of elevated access, such as admin credentials, before the flaw can be triggered. The advisory does not spell out how that access is obtained, so do not assume the device is safe just because it is not wide open. Weak or default admin passwords, or an exposed management page, would make that prerequisite much easier to meet.
Who is realistically exposed
- Owners of a WAVLINK WN553X1-B running 260403_2.0.0, the only version named in the advisory.
- Devices whose web management interface or other management services are reachable from the internet, or from untrusted parts of the local network such as guest Wi-Fi.
- Devices with default, shared or weak admin credentials, given the high privileges requirement.
- Sites where the device sits in front of business systems, since a compromised network device can expose traffic and internal hosts.
The research covers only the WN553X1-B. If you own other WAVLINK equipment, it is still sensible to check its firmware version and management exposure, but nothing in the sources says other models are affected.
How to check your exposure
Start by confirming whether you have the device and which firmware it runs. The firmware version is normally shown on the device's admin status or about page. Look for 260403_2.0.0.
Then check whether the management interface is reachable from outside. From a machine on a different network, such as a phone on mobile data, try to open your public IP address in a browser. If you see the router login page, remote management is exposed. You can also review the router's own settings for remote administration or port forwarding rules that point to the device itself.
If you run a web server behind the same connection, you can check your public footprint with the free security headers checker and the SSL checker, though neither tests router firmware.
What to do now
The advisory lists no patched version, so the steps below reduce exposure rather than remove the flaw. Check the WAVLINK support pages for firmware newer than 260403_2.0.0 and read its release notes, since we cannot confirm one exists.
0 of 8 done
Detection and monitoring
Watch for signs that a device has been tampered with: unexpected reboots, changed DNS settings, new admin accounts, unfamiliar port forwards, or outbound connections you do not recognize. If the device logs administrative logins, review them for unknown source addresses.
From the outside, you can keep an eye on the services behind your connection. Monitoring for uptime, certificate and DNS changes, such as Webforta Monitor, can flag unexpected changes to your public records, which is one symptom of network gear being altered. It does not test this device for the flaw. If you suspect a compromise, follow our guide on what to do when a website is hacked and treat any credentials that passed through the device as exposed. For broader habits, see our small business website security guide.
What is still unknown
- Whether WAVLINK has released a fixed firmware version. The advisory lists patched versions as unknown.
- Whether other WN553X1-B firmware versions are affected.
- Whether the flaw is being exploited in the wild. The advisory only says the exploit is public and may be used.
- How an attacker would obtain the high privileges the CVSS metrics call for.
We will treat these as open until the vendor or a reviewed advisory says otherwise.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.