WAVLINK WN553X1-B OpenVPN CLI ioos sub_416568 os command injection
Affects WAVLINK WN553X1-B firmware V260403_2.0.0 (OpenWrt 21.02, aarch64 / MT7981). The vulnerable branch is reached only when additional OpenVPN client parameters are supplied. No fix is listed in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 22/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The WAVLINK WN553X1-B router firmware's OpenVPN command-line handler (the /bin/ioos component) contains a flaw in how it processes a file identifier argument, allowing an attacker to remotely inject operating system commands. Successful exploitation could let an attacker run arbitrary commands on the device with its privileges, potentially taking control of the router.
Read the original description
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
What to do
Check whether your setup matches what the bug needs.
Affects WAVLINK WN553X1-B firmware V260403_2.0.0 A valid session token is required, obtained via the login endpoint; factory-default password is admin Additional OpenVPN client parameters must be supplied to reach the vulnerable branchWorkaround: The checked facts give no workaround. They note that the attack needs a valid session token from the login endpoint and extra OpenVPN client parameters to reach the vulnerable branch, but they do not say how to block either.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- WAVLINK WN553X1-B
V260403_2.0.0
Evidence 5
- Advisory
- Advisory
- Advisory
- Advisory
- Exploit
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120231
What does this mean?
The OpenVPN client CLI handler passes input to the operating system without proper checks, so a command can be injected and run as root on the device. A valid session token from the login endpoint is required first.Source: github.com
Am I affected, and how do I check?
The checked facts list WAVLINK WN553X1-B firmware V260403_2.0.0 (OpenWrt 21.02, aarch64 / MT7981) as affected. The vulnerable branch needs additional OpenVPN client parameters, so the firmware version and the OpenVPN client configuration are the things to check.Source: github.com
What should I do about it?
The checked facts do not name a fixed firmware version or an upgrade target. Check the vendor's support channels for an updated firmware before relying on any version.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts give no workaround. They note that the attack needs a valid session token from the login endpoint and extra OpenVPN client parameters to reach the vulnerable branch, but they do not say how to block either.Source: github.com