CVE-2026-120229

Summary

The WAVLINK WN553X1-B firmware v260403_2.0.0 contains an OS command injection vulnerability in the /bin/ioos binary, specifically within function sub_416B50, where unsanitized user input passed as file_id allows attackers to inject and execute arbitrary shell commands remotely.

Exploitability

Exploitation requires high-privilege access (PR:H) and no user interaction, but the exploit is publicly available, lowering the barrier for low-skill attackers with valid credentials.

Blast radius

Successful exploitation grants full system compromise (C:H/I:H/A:H) including confidentiality, integrity, and availability, potentially enabling persistent backdoor installation, data exfiltration, or device brick.

Detection

Monitor /var/log/messages or syslog for unexpected shell command invocations (e.g., lines containing 'sh ', 'bash ', 'exec ', or '/bin/ioos' with suspicious file_id arguments), and watch for outbound connections to non-standard ports from the device's IP after authentication. No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 260403_2.0.1 or later, as the vendor has released a patched version; until then, restrict administrative access to trusted IP ranges and disable remote management if not required.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.