CVE-2026-120238

Summary

The WAVLINK WN553X1-B firmware v260403_2.0.0 contains an OS command injection vulnerability in the /bin/ioos binary's sub_4162A8 function, triggered by unsanitized user input passed as file_id to the ovpn_file handler, allowing remote authenticated attackers to execute arbitrary commands on the device.

Exploitability

Exploitation requires low-privilege network access (PR:L) with no user interaction needed (UI:N), and a publicly available exploit exists.

Blast radius

Successful exploitation grants full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) on the affected device, potentially enabling lateral movement within the internal network or persistent backdoor access.

Detection

Look for HTTP POST requests to the OpenVPN file upload endpoint containing suspicious file_id parameters with shell metacharacters (e.g., ';', '|', '$(') or unexpected command sequences in web server or application logs; also monitor for spawned /bin/ioos processes executing non-standard arguments.

Prioritized remediation

Upgrade to firmware version 260403_2.0.1 or later, as the vendor has released a patched version; until then, disable remote OpenVPN file management functionality and restrict access to the /bin/ioos endpoint to trusted internal IPs only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.