CVE-2026-120344: WAVLINK WN551X3-A Command Injection

On this page (7 sections)

A critical vulnerability, tracked as CVE-2026-120344, has been published for the WAVLINK WN551X3-A router. According to the NVD record, a flaw in the WireGuard CLI group handler lets a manipulated group_name argument lead to OS command injection, and the attack may be performed remotely.

The record also states that the exploit has been disclosed to the public and may be used. If you run this router at an office, a shop, a branch site or a client location, treat it as an exposed device until you know otherwise. The research available today comes from a single source, so several details below are marked as unconfirmed.

What was disclosed

The NVD entry, published on 2026-11-02, describes a flaw in the function system of the file /bin/ioos, in a component called the WireGuard CLI Group Handler. The affected build is listed as M51X3_V251020-WO-182e965. The description says that manipulating the group_name argument results in OS command injection, that the attack may be launched from a remote position, and that the vendor was contacted early about the disclosure.

The record points to a public write-up on GitHub and to VulDB entries as references. We have not reproduced any technical exploit detail here, and this article does not include any.

Why command injection on a router is serious

OS command injection happens when a device builds a system command from text that a user or client supplies and does not properly separate data from instructions. If an attacker controls part of that text, the device may run commands the owner never intended. Because routers usually run with high privileges, a successful attack can mean control of the device itself.

A router sits between your network and the internet. A compromised one can expose traffic passing through it, change DNS settings, open access into the internal network, or be used to attack other systems. That is why a 9.3 score on a network edge device deserves quick attention, even before more details emerge.

Who is realistically exposed

Owners of the WAVLINK WN551X3-A, in particular the build string M51X3_V251020-WO-182e965 named in the record.
Sites where the router's management interface or WireGuard-related services are reachable from the internet. The record says the attack may be remote, but does not say whether authentication is required. Do not assume it is.
Small offices, shops and agencies that deploy low-cost routers at client locations and rarely check their firmware.
Anyone who cannot confirm which model and firmware a given device runs.

The research does not say which other WAVLINK models or firmware builds are affected, and it does not name a patched version. Do not assume a different firmware build is safe or vulnerable without checking the vendor's pages.

How to check your exposure

Start with an inventory. Log in to the router's admin page from inside your network and note the model and firmware version shown there. Compare the firmware string with M51X3_V251020-WO-182e965.

Next, find out whether the admin interface is reachable from outside. From a device that is not on your network (for example a phone on mobile data), try to open the router's public IP address in a browser. If a login page or any management page loads, remote access is on.

If you manage the router from a Linux machine inside the network, this read-only command lists which TCP ports are open on the router. Replace 192.168.1.1 with your router's address and look for web management or VPN-related ports you did not intend to leave open. Only scan devices you own or administer.

List open TCP ports on your own router from inside the network (requires nmap)Shell

nmap -Pn 192.168.1.1

You can also review the router's logs, if it keeps any, for unexpected configuration changes, new user accounts, new WireGuard peers or groups you did not create, and unfamiliar DNS settings.

What to do now

No fixed firmware version is confirmed in the research, so the focus is on reducing exposure and watching for a vendor update.

Identify every WAVLINK WN551X3-A you own or manage, and record its firmware version.
Turn off remote (WAN-side) administration unless you truly need it.
If WireGuard is configured on the device and you do not use it, disable it.
Restrict the management interface to a trusted internal network or a dedicated management VLAN.
Change the admin password to a long, unique one, and remove any unused accounts.
Check WAVLINK's support and download pages for new firmware, and apply it as soon as a fix is published.
If the router sits directly on the internet and cannot be locked down, consider placing it behind another firewall or replacing it.
Review router settings (DNS servers, port forwards, VPN peers) for changes you did not make.

Caution. Changing firewall rules or disabling remote administration can lock you out if you are managing the router remotely. Make these changes from a device on the local network, and keep a note of the original settings.

Tip. For client sites, keep a simple list of router models, firmware versions and whether remote management is enabled. When the next advisory arrives, you will know in minutes which locations are affected.

Detection and monitoring afterwards

Watch the NVD entry and the vendor's support pages for updates, since the record may be revised with fix information or additional affected versions. If you notice unexplained router reboots, changed settings or odd outbound traffic, treat the device as possibly compromised: back up its configuration, reset it, update the firmware if available, and set new credentials.

For the websites behind the router, an external check can show whether your public services and certificates still look as expected. Webforta's free SSL checker and monitoring cover certificate and DNS changes, which can help you notice if something upstream was altered. They do not detect this router flaw. If you suspect a break-in, see website hacked: what to do.

What we do not know yet

Whether WAVLINK has released a fixed firmware version.
Whether authentication is needed to reach the vulnerable function.
Whether the flaw is being exploited against real devices. The record only says a public exploit exists.
Whether other WAVLINK models share the same code.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

CVE-2026-120344: A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965.nvd.nist.gov · 2 November 2026

Frequently asked questions

What is CVE-2026-120344?

It is a critical OS command injection vulnerability (CVSS 9.3 in the CVE record) in the WireGuard CLI group handler of the WAVLINK WN551X3-A router, build M51X3_V251020-WO-182e965. Manipulating the group_name argument can lead to command injection, and the attack may be performed remotely.

Is there a patch for the WAVLINK WN551X3-A?

The research does not name a fixed version or confirm that a patch exists. The record says the vendor was contacted early. Check WAVLINK's support pages for firmware updates and apply one as soon as it is available.

Is CVE-2026-120344 being exploited in the wild?

That is unconfirmed. The record says the exploit has been disclosed to the public and may be used, but it does not report attacks on real devices, and the CVE is not listed in CISA KEV at the time of writing.

How can I reduce risk if no update is available?

Disable remote administration, turn off WireGuard if you do not use it, limit management access to a trusted internal network, use a strong unique admin password, and consider putting the router behind another firewall or replacing it if it must face the internet.

What is OS command injection?

It is a weakness where a program passes untrusted input into a system command without proper handling, so an attacker can make the device run commands of their choosing. On a router, this can lead to control of the device and the traffic passing through it.

Keep reading