On this page (7 sections)
A command injection flaw, tracked as CVE-2026-120231, has been published for the WAVLINK WN553X1-B router, firmware version V260403_2.0.0. According to the GitHub Advisory Database entry, it can be triggered remotely, and details of the exploit have been publicly disclosed.
If you run this router at an office, a shop or a remote site, or manage one for a client, you should know where it is reachable from and who can talk to its management interface. The advisory lists no fixed version, so the practical work right now is reducing exposure.
What was disclosed
The advisory describes a flaw in a function named sub_416568 in the file /bin/ioos, part of what it calls the OpenVPN CLI Handler component. Manipulating an argument named file_id leads to OS command injection. The record states the attack can be started remotely and that the vendor was contacted early about the disclosure.
The record was published on November 1, 2026. Only one independent publisher covers this so far. The NVD entry repeats the same text, so it is not separate confirmation. A third-party write-up is referenced from the advisory, but we have not relied on it for any detail beyond what the advisory says.
What the weakness means in plain terms
OS command injection happens when a device builds a system command out of input it receives and fails to separate that input from the command itself. An attacker who controls the input can make the device run commands of their choosing. On a router, that typically means control over the very device that sits between your network and the internet.
The CVSS v4 metrics in the advisory describe network attack vector, low attack complexity, no attack requirements, low privileges required and no user interaction. Impact on confidentiality, integrity and availability is rated high, for both the vulnerable system and subsequent systems. In short, an attacker with a low-privileged account and network reach to the affected function does not need a victim to click anything.
Who is realistically exposed
- Sites and offices using a WAVLINK WN553X1-B on firmware V260403_2.0.0, the only version named in the record.
- Devices whose administration pages or VPN services can be reached from the internet, since the issue is described as remotely exploitable.
- Devices where more than one person holds a login, since the attack is rated as needing only low privileges. The advisory does not say how those privileges are obtained.
- Other firmware versions and models may or may not be affected. The advisory does not say, so do not assume they are safe.
For a hosted website, a compromised router at your office is not the same as a compromised server. It can still expose admin sessions, credentials typed on the local network and traffic to your management panels, so it belongs in your risk review.
How to check your exposure
Start by finding out whether you own the affected model and version. Log in to the router's admin page from the local network and read the model name and firmware version on the status or system page. Compare it to V260403_2.0.0.
Then check what is reachable from outside. From a machine outside your network (for example a mobile hotspot), run a read-only port check against your public IP address. It lists which of the given ports answer and sends no exploit traffic. Only scan addresses you own.
nmap -Pn -p 22,23,80,443,1194,8080,8443 YOUR_PUBLIC_IPIf the web admin page, SSH, Telnet or an OpenVPN port answers from the internet, note it down. Those are the services to restrict first.
What to do now
There is no patch listed in the advisory, so these steps are about shrinking the attack surface and watching for signs of trouble. Check the WAVLINK support site for a firmware update for your model, and apply it once one that addresses this CVE is published.
0 of 9 done
Detection and monitoring
Because the exploit is publicly disclosed, it is reasonable to assume scanning for this model may follow. Signs worth checking on the router include unexpected changes to DNS settings, new port-forwarding rules, unknown user accounts, unfamiliar settings, and unexplained reboots. Review any logs the device keeps and, if you forward them to a log server, search for repeated requests to the VPN or management endpoints from unfamiliar addresses.
If you suspect compromise, follow the usual steps in our guide on what to do when a website is hacked: isolate the device, change credentials that passed through it, and restore from a known good configuration or reset it to factory settings before reconfiguring.
For the public-facing side of your setup, you can use the free SSL checker and Webforta Monitor to watch certificate, DNS and header changes on your sites, which can help you notice unexpected changes. These cannot see inside a router or tell you whether it is vulnerable.
What we do not know yet
- Whether WAVLINK has released or plans a fixed firmware version. The advisory lists patched versions as unknown.
- Which other firmware versions or models are affected.
- Whether the flaw is being exploited in real attacks. The advisory says the exploit is publicly disclosed and may be used, but the research contains no confirmation of attacks.
- What exact privilege level is needed to reach the vulnerable function.
Until the vendor says more, lowering exposure is the safest course.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.