CVE-2026-120228

Summary

A remote OS command injection flaw exists in the ioos service of WAVLINK WN553X1-B firmware V260403_2.0.0, where unsanitized user input passed as group_id/group_name to sub_416D88 allows arbitrary command execution via the /bin/ioos binary.

Exploitability

Exploitation requires low-privilege authenticated access (PR:L) with no user interaction needed (UI:N), and can be performed remotely over the network (AV:N).

Blast radius

Successful exploitation grants high confidentiality, integrity, and availability impact (C:H/I:H/A:H), enabling full device compromise including credential theft, persistence, and lateral movement within the local network.

Detection

Look for unusual command-line arguments passed to /bin/ioos in system logs (e.g., syslog, kernel logs), especially containing shell metacharacters like ';', '|', '$(', or backticks; also monitor for unexpected outbound connections from the device to external IPs not in known whitelist.

Prioritized remediation

Upgrade to firmware version V260403_2.0.1 or later, as the vendor has released a patch for this issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.