On this page (8 sections)
A critical vulnerability, CVE-2026-120345, has been published for the WAVLINK WN551X3-A router. According to the GitHub Advisory Database entry, a function in the DNS Resolution Handler component can be abused for OS command injection, and the attack can be started remotely. The advisory says an exploit has been made public.
If you run this router at an office, a store, a client site or a small hosting setup, you should treat it as exposed until you know otherwise. The advisory lists no patched version, so much of the useful work here is reducing exposure rather than applying an update.
At a glance
What happened
The vulnerability was published on November 2, 2026 by the National Vulnerability Database and listed the same day in the GitHub Advisory Database. The description says the flaw sits in the function sub_41a430 of the file /bin/ioos, part of the DNS Resolution Handler, and that manipulating the argument named data results in OS command injection.
The advisory also states that the vendor was contacted early about the disclosure. It does not say whether WAVLINK has responded, released a fix or published its own advisory. The GitHub entry is marked unreviewed and lists affected and patched versions as unknown. The NVD record repeats the same text, so it is not independent confirmation. Only one source of technical detail exists so far.
Technical details in plain terms
OS command injection happens when a device takes input from a request and passes it, without proper checking, to a shell or system command. An attacker who controls that input can make the device run commands of their choosing. On an embedded device such as a router, that can mean control over the whole system.
The CVSS v4 metrics in the GitHub advisory describe the problem as reachable over the network, low complexity, with no privileges, no attack requirements and no user interaction. Impact on confidentiality, integrity and availability is rated high, for both the vulnerable system and subsequent systems. In practical terms, if the vulnerable service can be reached, the scoring assumes no login is needed.
A technical write-up is linked from the advisory and is hosted on GitHub. We are not reproducing exploit details here.
Who is realistically exposed
- Owners of a WAVLINK WN551X3-A, particularly if the management interface or other services are reachable from the internet.
- Small businesses and agencies that deployed this router at client locations and may not track its firmware.
- Anyone on the same local network as an attacker or a compromised device, since the research does not rule out local reachability.
- Websites and services hosted behind or reached through such a router, because a compromised router can redirect or intercept traffic, including DNS lookups.
A router takeover is not a website vulnerability, but it can affect websites indirectly. An attacker with command execution on the gateway could change DNS settings, capture traffic or use the device as a foothold inside the network. Those are general consequences of router compromise, not behavior confirmed for this CVE.
How to check your exposure
- Identify the model and firmware. Look at the label on the device and the status or firmware page in its admin interface. Compare it to the model WN551X3-A and the firmware string M51X3_V251020-WO-182e965 named in the advisory.
- Check whether the admin interface is reachable from outside. From a network that is not your own (for example a phone on mobile data), try to open the router's public IP address in a browser. If a login page or any response appears, remote access is on.
- Review router settings for remote management, UPnP and port forwarding, and note anything you did not set up yourself.
- Check the DNS servers configured on the router and on your clients. Unexpected resolvers are a sign of tampering.
- Look for unexplained reboots, changed settings, new accounts or unfamiliar outbound connections in whatever logs the router provides.
What to do now
Because no patch is listed, the aim is to cut off remote reach to the device and watch for vendor updates. These are general hardening measures. The research does not confirm that any of them fully blocks this specific flaw.
0 of 9 done
Detection and monitoring
The advisory says the exploit is public, which raises the chance of attempts against exposed devices, but the research reports no confirmed exploitation so far. Watch for the signs that a router has been tampered with:
- DNS resolvers on the router or clients that you did not choose.
- Admin settings, accounts or port forwards that changed without your action.
- Unexpected outbound traffic from the router, or spikes in traffic at odd hours.
- Sudden certificate warnings on sites you normally reach without issues, which can point to traffic interception.
For your own websites, outside monitoring helps you notice knock-on effects such as DNS record changes or unexpected certificate changes. Webforta Monitor tracks uptime, certificates and DNS, and the free SSL checker lets you spot-check a certificate. These watch your sites from the outside and cannot tell you whether a router at your office is vulnerable. If you suspect a wider compromise, follow our guide on what to do when a website is hacked.
What to watch next
Keep an eye on the NVD record and the GitHub advisory, as the affected and patched version fields may be filled in later. If you run other WAVLINK equipment, check each model you own against published advisories. A vendor statement or confirmed exploitation would change the urgency, and until a primary source states either, we treat them as unconfirmed.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.