CVE-2026-120229 in WN553X1-B
Summary
by MITRE • 11/01/2026
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/01/2026
The vulnerability identified in WAVLINK WN553X1-B firmware version 260403_2.0.0 represents a critical security flaw within the device's operating system component, specifically located in the binary file /bin/ioos at function address sub_416B50. This issue is classified as an OS command injection vulnerability, which falls under CWE-78: Improper Neutralization of Special Elements used in an Operating System Command. The root cause lies in the inadequate validation and sanitization of input data passed to the file_id argument within this specific function. When a user or external entity provides maliciously crafted input for the file_id parameter, the application fails to properly escape special characters that are significant to the operating system shell. This oversight allows an attacker to inject arbitrary commands into the execution context of the vulnerable process, effectively bypassing intended security controls and gaining unauthorized access to underlying system functionalities.
The operational impact of this vulnerability is severe due to its remote exploitability. Since the attack can be carried out remotely without requiring prior authentication or physical access to the device, it significantly lowers the barrier for entry for threat actors. An attacker located anywhere on the network where the router is accessible can potentially execute arbitrary system commands with the privileges of the compromised process. This capability often leads to full device compromise, allowing the adversary to install persistent backdoors, exfiltrate sensitive data such as Wi-Fi credentials and connected client information, or use the compromised router as a pivot point for further attacks against other devices on the local network. The fact that an exploit has been publicly disclosed increases the risk of automated scanning and widespread exploitation by malicious actors who monitor public vulnerability databases for actionable attack vectors.
From a threat intelligence perspective, this type of vulnerability aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter execution, particularly those involving indirect command invocation through vulnerable applications. The presence of publicly available exploits suggests that automated botnets may already be targeting devices running this specific firmware version. Organizations relying on these access points for network segmentation or internet connectivity face heightened risks of lateral movement and data breach if the vulnerability remains unpatched.
Mitigation strategies must prioritize immediate remediation efforts. Users should update their WAVLINK WN553X1-B routers to the latest firmware version released by the vendor, which likely contains patches addressing this input validation flaw. If an updated firmware is not yet available or cannot be applied immediately, network-level controls such as strict firewall rules restricting inbound access to management interfaces and disabling unnecessary remote administration features can help reduce the attack surface. Additionally, monitoring network traffic for anomalous outbound connections from IoT devices may aid in early detection of exploitation attempts. Continuous vigilance regarding vendor security advisories is essential until a permanent software fix is deployed across all affected units.