{"id":"CVE-2026-120228","published":"2026-11-01T14:18:52.883","lastModified":"2026-11-01T14:18:52.883","description":"A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK%20WN553X1-B%20Router.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120228","tags":[]},{"url":"https://vuldb.com/submit/919151","tags":[]},{"url":"https://vuldb.com/vuln/429587","tags":[]},{"url":"https://vuldb.com/vuln/429587/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK%20WN553X1-B%20Router.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A remote OS command injection flaw exists in the ioos service of WAVLINK WN553X1-B firmware V260403_2.0.0, where unsanitized user input passed as group_id/group_name to sub_416D88 allows arbitrary command execution via the /bin/ioos binary.","exploitability":"Exploitation requires low-privilege authenticated access (PR:L) with no user interaction needed (UI:N), and can be performed remotely over the network (AV:N).","blast_radius":"Successful exploitation grants high confidentiality, integrity, and availability impact (C:H/I:H/A:H), enabling full device compromise including credential theft, persistence, and lateral movement within the local network.","remediation":"Upgrade to firmware version V260403_2.0.1 or later, as the vendor has released a patch for this issue.","detection":"Look for unusual command-line arguments passed to /bin/ioos in system logs (e.g., syslog, kernel logs), especially containing shell metacharacters like ';', '|', '$(', or backticks; also monitor for unexpected outbound connections from the device to external IPs not in known whitelist.","tags":["rce","command-injection","embedded-device","firmware","authenticated"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:49:03.049Z"}}