On this page (7 sections)
CVE-2026-120240 is an OS command injection vulnerability in the WAVLINK WN553X1-B router, firmware version V260403_2.0.0. According to the NVD record, it sits in the WireGuard CLI group handler and can be triggered remotely. The record also states that the exploit has been publicly disclosed and may be used.
If you run this router at an office, a shop, a branch site or a client location, especially with remote administration or a WireGuard VPN enabled, this is worth a quick check today. At the time of writing, the research we have does not list a fixed firmware version.
What happened
The NVD entry, published on 2026-11-01, says a flaw was determined in the WAVLINK WN553X1-B on firmware V260403_2.0.0. Manipulating the group_id or group_name argument in the WireGuard CLI group handler can lead to operating system command injection. The record says the attack may be performed remotely and that the vendor was contacted early about the disclosure.
The record links to a public write-up on GitHub and to VulDB entries, including the VulDB CVE page. Only one independent publisher covers this story so far, so details beyond the NVD description, including whether authentication is required, are not confirmed here. We have deliberately left out exploit specifics.
Technical details in plain terms
Command injection happens when a device builds a system command from text a user supplies and does not clean that text first. If the router passes a WireGuard group name or ID straight into a shell command, specially crafted input can make the router run extra commands of the attacker's choosing. On a router, those commands usually run with high privileges.
The NVD record maps this to CWE-77 and CWE-78, the generic and OS-level command injection categories. A successful attack on a router could in principle expose traffic, VPN settings and the internal network behind it, but the research does not describe the actual impact in detail, so treat that as the general risk of this weakness class rather than a confirmed outcome.
Who is affected
- Owners of the WAVLINK WN553X1-B running firmware V260403_2.0.0, the only version named in the record.
- Sites where the router's management interface or WireGuard configuration features are reachable from the internet or from untrusted networks.
- Agencies and hosting or IT administrators who deployed these routers at client sites and may not have them in an asset list.
- Other firmware versions of this model may or may not be affected. The research does not say, so verify with the vendor.
How to check your exposure
- Find every WAVLINK WN553X1-B on your networks, including ones at client or branch sites.
- Log in to the router's admin page from inside your network and read the firmware version. Compare it with V260403_2.0.0.
- Check whether the admin interface is reachable from the internet, for example through port forwarding or a remote management setting.
- Check whether WireGuard features are enabled and who can reach them.
- Review router and firewall logs for unexpected logins, configuration changes or unfamiliar outbound connections.
The free security headers checker and SSL checker cover websites, not routers. Use them for your web servers and rely on your own firewall review for the router itself.
What to do now
0 of 7 done
Detection and monitoring
Because there is no confirmed fix in the research, monitoring is your main safety net. Watch for new admin sessions, changed DNS settings on the router, new port forwards, unexpected WireGuard peers and unusual outbound traffic from the device. If you suspect a compromise, follow our guide on what to do when a website is hacked and treat the router as untrusted until it is reset and reconfigured.
For the websites behind the router, Webforta Monitor can alert you to uptime, certificate and DNS changes, which can be early signs that something upstream has gone wrong. It does not inspect or protect the router itself.
What we do not know yet
- No fixed firmware version is named in the research.
- Whether the flaw needs authentication is not stated.
- Exploitation in the wild is not confirmed. The record only says the exploit is public and may be used, which raises the odds that scanning and attempts will follow.
- Whether other firmware versions or models are affected is not stated.
Check the NVD entry and WAVLINK's own support channels for updates. For more security news, see the Webforta blog.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.