Paper/Archive/CVE-2026-120229

CVE-2026-120229

WAVLINK WN553X1-B — WAVLINK WN553X1-B ioos sub_416B50 os command injection

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 No EPSS score.000 × 200.0 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

Affected

ProductAffectedFixed inSource

WN553X1-B260403_2.0.0–CNA

Scores by source

VulDB (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

VulDB (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

VulDB (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R

References

writeupvuldb.com/vuln/429588 refvuldb.com/vuln/429588/cti writeupvuldb.com/cve/CVE-2026-120229 writeupvuldb.com/submit/919153 exploitgithub.com/senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK_WN553X1-B_check_pwd_command_injection.md