CVE-2026-120344

Summary

The WAVLINK WN551X3-A device's WireGuard CLI handler in /bin/ioos allows remote OS command injection via manipulation of the 'group_name' argument to the 'system' function, enabling full system compromise.

Exploitability

Exploitation is straightforward and requires only network access; no authentication or user interaction is needed.

Blast radius

Successful exploitation grants attackers full remote control of the device, potentially enabling lateral movement, data exfiltration, or use as a pivot point in broader attacks.

Detection

Look for unexpected calls to /bin/ioos with suspicious 'group_name' parameters containing shell metacharacters (e.g., ';', '|', '$(', backticks) in system logs or debug output from the device; also monitor for outbound connections to non-standard ports or unusual DNS requests originating from the device after such log entries.

Prioritized remediation

Upgrade to firmware version M51X3_V251020-WO-182e965-patched or later if available; otherwise, disable the WireGuard CLI functionality and restrict network access to the management interface until a patch is applied.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.