---
id: CVE-2026-120240
title: WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os command injection
summary: >-
  A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue
  affects the function sub_41A748 of the file /bin/ioos of the component
  WireGuard CLI Group Handler. Executing a manipulation of the argument
  group_id/group_nam…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'
cvssSource: cna
cwe:
  - CWE-78
  - CWE-77
vendor: WAVLINK
product: WN553X1-B
affected:
  - WN553X1-B V260403_2.0.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-02T14:30:20.112203Z'
exploitAvailable: true
published: '2026-11-01'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T14:30:33.865Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120240'
references:
  - url: 'https://vuldb.com/vuln/429599'
    label: >-
      VDB-429599 | WAVLINK WN553X1-B WireGuard CLI Group ioos sub_41A748 os
      command injection
  - url: 'https://vuldb.com/vuln/429599/cti'
    label: 'VDB-429599 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-120240'
    label: CVE-2026-120240 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/919251'
    label: 'Submit #919251 | Wavlink Router Firmware V260403_2.0.0 Command Injection'
  - url: >-
      https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_group_command_injection.md
tags:
  - cve.org
  - exploit-available
epss: 0.01687
epssPercentile: 0.77096
ingestedAt: '2026-11-05T19:30:42.664Z'
---

## Overview

A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

## Affected

- `WN553X1-B V260403_2.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.