On this page (7 sections)
A command injection flaw has been published for the WAVLINK WN553X1-B router, firmware version 260403_2.0.0. According to the GitHub Advisory Database entry, the bug sits in the OpenVPN file handler (ovpn_file) and the attack can be executed remotely. The advisory references a public write-up of the issue.
If you run this router at an office, a shop, a branch site or for a client, treat it as an exposed network device until the vendor says otherwise. The research does not list a fixed firmware version, so the practical focus is on limiting who can reach the device.
What happened
The NVD record for CVE-2026-120238 was published on November 1, 2026. It describes a vulnerability in the function sub_4162A8 of the file /bin/ioos, part of the ovpn_file handler. Manipulating the argument file_id leads to OS command injection.
The advisory states the vendor was contacted early about the disclosure. The research shows no vendor response, advisory or firmware update. The NVD text repeats the GitHub advisory wording, so there is effectively one source of technical detail so far. The advisory also links a third-party write-up and VulDB entries, which we have not reviewed.
What the weakness means in plain terms
OS command injection happens when a device builds a system command from a value a user supplies, such as a file identifier, without strictly validating it. Someone who controls that value may be able to make the device run commands the manufacturer never intended. The research does not say what privilege level the /bin/ioos handler runs with on this device.
The GitHub Advisory Database page lists a CVSS v4 base score of 8.6 (high) with these metrics: network attack vector, low attack complexity, no attack requirements, low privileges required, and no user interaction. Confidentiality, integrity and availability impact are all rated high, for both the vulnerable system and subsequent systems. The research does not say who calculated the score, and the NVD text we have contains no CVSS data.
The 'Privileges Required: Low' metric hints that some level of access may be needed, but the research does not explain what that means for this router or whether it applies in every configuration. Do not assume an unauthenticated attacker is ruled out, and do not assume one is possible either.
As a general point, a router sits between your network and the internet, so a compromised one can have wide consequences. That is a general observation about network devices, not behavior reported for this specific bug.
Who is affected
- Owners of the WAVLINK WN553X1-B running firmware 260403_2.0.0, which is the only version named.
- Anyone whose router web interface or management services are reachable from the internet, or from a network that untrusted users share.
- Agencies and hosting or IT administrators who deployed this model for clients and may not track its firmware.
- Other firmware builds of the same model: unknown. Do not assume they are safe.
How to check your exposure
- Find the model and firmware version in the router's admin page (usually under a status or system information section) and compare it with 260403_2.0.0.
- Check whether the admin interface answers from outside your network. From a device that is not on your LAN (for example a phone on mobile data), try to open the router's public IP address in a browser. If a login page loads, the interface is exposed.
- Review router settings for remote management, port forwarding and any OpenVPN or file upload features, and note which are enabled.
- Look at the router's logs, if it keeps any, for unfamiliar logins, configuration changes or unexpected reboots.
What to do now
No fixed firmware is confirmed in the research, so the goal is to reduce exposure and be ready to update quickly.
0 of 9 done
Detection and monitoring
Routers rarely send useful alerts, so watch from the outside. Confirm periodically that only the ports you expect are reachable, and that the public IP of your site still resolves to the right place. Unexpected DNS changes, new certificate warnings or sudden slowness can be signs that something upstream of your website has been tampered with. A certificate and DNS change monitor can flag some of these changes, and the free SSL checker lets you verify what visitors actually see.
For your websites themselves, a router flaw is a reminder to check for unrelated compromise too. See our guide on how to check if a website is hacked if you see unexplained behavior.
What is still unknown
- Whether WAVLINK has released or plans a patched firmware version.
- Whether versions other than 260403_2.0.0 are affected.
- Whether the flaw requires authentication in every setup, beyond the low privileges noted in the CVSS metrics.
- Whether anyone is exploiting it in the wild. The advisory only says the exploit is public and may be used.
We will not guess at these points. The advisory is marked Unreviewed in the GitHub Advisory Database, and affected and patched versions are listed there as unknown.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.