CVE-2026-120239

Summary

The WAVLINK WN553X1-B V260403_2.0.0 device's WireGuard CLI handler (/bin/ioos, function sub_419DA8) suffers from OS command injection when the 'file_id' argument is manipulated, allowing remote attackers with low privileges to execute arbitrary commands on the underlying system.

Exploitability

Exploitation is straightforward for authenticated low-privilege users due to lack of input sanitization; public exploits exist and require only network access to the vulnerable WireGuard interface.

Blast radius

Successful exploitation grants full system compromise (confidentiality, integrity, availability) on the device, potentially enabling lateral movement within the local network or abuse as a pivot point.

Detection

Look for unusual subprocess invocations in /var/log/messages or dmesg logs (e.g., execution of wget, curl, nc, or shell commands from /bin/ioos), anomalous outbound connections to unexpected IPs on non-standard ports, or unexpected file creation/modification in /tmp or /var directories by the ioos process.

Prioritized remediation

Upgrade to firmware version V260403_2.0.1 or later, as the vendor has released a patch; until then, disable the WireGuard CLI handler feature if not strictly required and restrict access to the /bin/ioos endpoint via ACLs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.