CVE-2026-120238 in WN553X1-B
Summary
by MITRE • 11/01/2026
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/01/2026
The WAVLINK WN553X1-B router, specifically firmware version 260403_2.0.0, contains a critical security flaw within its OpenVPN file handling component that allows for remote code execution via operating system command injection. This vulnerability resides in the sub_4162A8 function of the /bin/ioos binary, which serves as part of the ovpn_file Handler subsystem responsible for managing files associated with VPN connections. The core technical flaw stems from improper input validation and sanitization mechanisms when processing the file_id argument passed to this specific handler function. Because the application fails to adequately restrict or escape special characters within user-supplied input, an attacker can inject arbitrary shell commands that are subsequently executed by the underlying operating system with the privileges of the vulnerable process.
From a technical perspective, this is a classic instance of CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. The vulnerability arises because the application directly concatenates or passes unsanitized user input into shell commands without employing safe APIs that separate code from data. In embedded systems like routers, such binaries often run with elevated privileges to manage network interfaces and configuration files. Consequently, successful exploitation allows an attacker to bypass standard access controls and execute system-level commands on the device kernel environment. This type of flaw is particularly dangerous in IoT devices because it can lead to full compromise of the hardware, turning it into a node within a botnet or providing a foothold for lateral movement across the local network.
The operational impact of this vulnerability is severe due to its remote exploitability and public availability. Since the attack vector is remote, an adversary does not need physical access to the device or prior authentication credentials if the vulnerable endpoint is exposed to untrusted networks such as the internet. The fact that a working exploit has been disclosed publicly significantly lowers the barrier for entry, enabling less sophisticated threat actors to launch automated attacks against susceptible devices. Once exploited, the attacker can potentially read sensitive configuration files, modify network settings, install persistent malware, or use the compromised router as a pivot point to attack other internal assets. This undermines the fundamental security purpose of the device, which is often to provide secure remote access through OpenVPN while simultaneously exposing itself to external threats if not properly hardened.
Mitigation strategies must address both immediate remediation and long-term defense posture. The primary solution is for users to update their router firmware to a version where this input validation issue has been patched by the vendor. If an official patch is unavailable, network-level controls should be implemented immediately. This includes restricting access to the management interface of the router from untrusted networks using firewall rules and ensuring that any exposed services are not accessible via port forwarding unless absolutely necessary. Additionally, implementing strict egress filtering can limit the damage if a device is compromised by preventing it from communicating with external command-and-control servers. Security teams should also monitor network traffic for anomalous patterns indicative of shell injection attempts or unusual outbound connections originating from IoT devices to detect potential exploitation in real-time.