On this page (7 sections)

A new vulnerability, CVE-2026-120239, has been published for the WAVLINK WN553X1-B router, firmware V260403_2.0.0. It is an OS command injection in the WireGuard CLI handler, and the advisory says it can be attacked remotely and that the exploit has been made public.

If you run this router at an office, a small business site or a remote location, or manage one for a client, this is worth checking today. The sources list no patched version, so reducing exposure is the main defense for now.

What was disclosed

According to the GitHub Advisory Database entry, the flaw sits in the function sub_419DA8 of the file /bin/ioos, in a component called the WireGuard CLI Handler. Manipulating the argument file_id leads to OS command injection. The NVD record carries the same text, so it is the same report and not a second confirmation.

The advisory states the attack can be carried out remotely, that the exploit has been made public and could be used, and that the vendor was contacted early about the disclosure. It does not say whether the vendor replied or released a fix. The GitHub entry is marked unreviewed.

Technical details in plain terms

OS command injection happens when a device builds a system command from input it receives and does not properly limit what that input can contain. An attacker who controls the input can make the device run commands it was never meant to run. On a router, those commands often run with high privileges.

The CVSS v4 metrics in the advisory describe a network attack vector, low attack complexity, no attack requirements, low privileges required and no user interaction. Impact on confidentiality, integrity and availability is rated high, for both the vulnerable system and subsequent systems. In practice that means a successful attack could give control of the router and a foothold on the network behind it.

The advisory's low privileges required rating suggests some form of login or access is needed. The sources do not say which account or interface that is, so do not assume an unauthenticated attacker is blocked.

Who is realistically exposed

  • Owners of a WAVLINK WN553X1-B running firmware V260403_2.0.0, the only version named in the advisory.
  • Devices whose web or command interfaces are reachable from the internet, or from a network you do not fully trust.
  • Setups that use the WireGuard feature, since the flaw is in its CLI handler. The sources do not say whether the feature must be enabled to be reachable, so treat all units on that firmware as at risk.
  • Other firmware versions are simply not covered by the research. Their status is unknown, not safe.

How to check your exposure

Start by finding out whether you have the device and which firmware it runs. Log in to the router's admin page from inside your network and read the firmware version in the status or system information section. Compare it with V260403_2.0.0.

Then check whether the admin interface answers from the internet. The command below only checks whether a port accepts a connection and changes nothing. Replace the placeholder with your own public address and run it from a host outside your network, only against your own equipment. A result of succeeded on either port means a web service is exposed there.

Test whether the router's web admin ports are reachable (run from a host outside your network)Shell
nc -zv YOUR_PUBLIC_IP 80 443

The service may not be the router's admin page, but it deserves a look. You can also run a read-only scan of a site you verify to see what your public address exposes.

What to do now

No fixed firmware is named in the research, so the steps below focus on limiting who can reach the device and watching for misuse.

Caution. Changing firewall rules or firmware on a router can cut off connectivity, including for remote sites. Make the changes from a machine on the local network and keep a copy of the current configuration before you start.
Tip. Do not rely on the admin login alone. If the interface must be reachable remotely, put it behind a VPN you control instead of exposing it directly.

Detection and monitoring

Signs of a compromised router can be subtle. Watch for changed DNS settings, new or modified WireGuard peers or configuration you did not create, unknown admin accounts, unexpected reboots, and traffic to addresses you do not recognize.

A router takeover often shows up first as strange behavior on the sites behind it. Monitoring for DNS and certificate changes can flag redirects or altered records, and our guide on checking whether a website is hacked covers what to look at next. If you find signs of compromise, follow what to do when a website is hacked, and reset the router to factory state, reflash trusted firmware and rotate any credentials or VPN keys that passed through it.

What we do not know yet

  • Whether WAVLINK has acknowledged the issue or released a fixed firmware.
  • Whether other firmware versions or WAVLINK models share the flaw.
  • Whether the flaw is being exploited in real attacks. The advisory only says a public exploit exists.
  • Exactly which interface and account level reaches the vulnerable handler.

Only one independent publisher covers this so far, and the NVD record repeats it. Treat this as an evolving story: the facts above may change as the vendor or other researchers respond.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

  1. CVE-2026-120239 - GitHub Advisory Databasegithub.com
  2. CVE-2026-120239: A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0.nvd.nist.gov ·
  • WAVLINK
  • CVE-2026-120239
  • command injection
  • router security
  • IoT