CVE-2026-120228

WAVLINK WN553X1-B ioos Service sub_416D88 os command injection

HIGH 8.6EPSS 1.7%

A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

Affected: WAVLINK · WN553X1-B
CVSS v4.0 VULDB: 8.6 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 VULDB: 9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v2.0 VULDB: 9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C
EPSS: 1.65% chance of exploitation in the next 30 days, 77th percentile
Published: 2026-11-01
Updated: 2026-11-02

Proof-of-concept exploits (1)

senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK%20WN553X1-B%20Router.mdRepo stars 1★ · pushed 2026-08-08 · snapshot
1 file
vulns/WAVLINK WN553X1-B Router.md

CVE references

https://vuldb.com/cve/CVE-2026-120228ADVISORY
https://vuldb.com/submit/919151ADVISORY
https://vuldb.com/vuln/429587REFERENCE
https://vuldb.com/vuln/429587/ctiREFERENCE

CVE-2026-120228

Proof-of-concept exploits (1)

CVE references

References

Related