CVE-2026-120344 in WN551X3-A
Summary
by MITRE • 11/02/2026
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in WAVLINK WN551X3-A M51X3_V251020-WO-182e965 represents a critical security flaw within the device's firmware, specifically located in the WireGuard CLI Group Handler component. This subsystem is responsible for managing network configurations and group settings via command-line interfaces exposed to users or other system processes. The core technical issue stems from improper input validation performed on the argument named group_name when invoking functions within the /bin/ioos binary. Because this parameter is directly concatenated into shell commands without adequate sanitization, it allows an attacker to inject arbitrary operating system commands. This type of flaw is classically categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. The lack of rigorous input filtering means that special characters such as semicolons or pipe symbols can terminate the intended command and initiate new ones, effectively bypassing any logical boundaries imposed by the application itself.
The operational impact of this vulnerability is severe due to its remote exploitability. Since the affected component handles network group configurations, it likely exposes an interface over the local area network that accepts user input for modifying WireGuard peer groups or settings. An attacker positioned on the same network segment can craft a malicious request containing injected shell commands as part of the group_name parameter. Upon execution by the vulnerable /bin/ioos process, these commands run with the privileges associated with that service account. In many embedded IoT devices like routers and access points, such services often operate with elevated permissions to ensure proper configuration management. Consequently successful exploitation grants the attacker full control over the underlying operating system of the device. This can lead to complete compromise of the network infrastructure, including the ability to intercept traffic, modify routing tables, install persistent backdoors, or pivot attacks into other parts of the internal network that were previously isolated from external threats.
From a threat intelligence perspective this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter which describes adversaries using native operating system utilities like sh or bash to execute commands. The fact that an exploit has been publicly disclosed significantly increases the risk landscape as automated scanning tools and opportunistic attackers can now leverage known proof-of-concept code to target vulnerable devices at scale. This public availability of exploits often leads to rapid widespread compromise across unpatched installations in both residential and enterprise environments where such hardware is commonly deployed for wireless connectivity. The vendor was contacted early regarding this disclosure indicating that the issue has been recognized but remediation status should be verified by administrators as immediate patching may not yet be available or applied universally.
Mitigation strategies must focus on both technical controls and administrative procedures until a firmware update addressing CWE-78 is released. Administrators should restrict network access to the management interfaces of these devices using firewall rules ensuring that only trusted IP addresses can interact with the WireGuard CLI components. If possible disabling unnecessary remote configuration features reduces the attack surface significantly. Additionally implementing strict input validation on any exposed APIs or web interfaces that trigger this binary function would prevent command injection if such controls were implemented by the vendor in future revisions. Security monitoring should be enhanced to detect anomalous outbound connections from IoT devices which may indicate successful exploitation and subsequent botnet enrollment. Regularly updating firmware when patches are provided remains the most effective long-term defense against these types of logic flaws inherent in embedded system development practices that prioritize functionality over secure coding standards.