{"id":"CVE-2026-120229","published":"2026-11-01T14:18:53.123","lastModified":"2026-11-01T14:18:53.123","description":"A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK_WN553X1-B_check_pwd_command_injection.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120229","tags":[]},{"url":"https://vuldb.com/submit/919153","tags":[]},{"url":"https://vuldb.com/vuln/429588","tags":[]},{"url":"https://vuldb.com/vuln/429588/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/senxitoyshuyi-ui/IOT-CVE/blob/main/vulns/WAVLINK_WN553X1-B_check_pwd_command_injection.md","tags":[]}],"hasPoc":true,"ai":{"summary":"The WAVLINK WN553X1-B firmware v260403_2.0.0 contains an OS command injection vulnerability in the /bin/ioos binary, specifically within function sub_416B50, where unsanitized user input passed as file_id allows attackers to inject and execute arbitrary shell commands remotely.","exploitability":"Exploitation requires high-privilege access (PR:H) and no user interaction, but the exploit is publicly available, lowering the barrier for low-skill attackers with valid credentials.","blast_radius":"Successful exploitation grants full system compromise (C:H/I:H/A:H) including confidentiality, integrity, and availability, potentially enabling persistent backdoor installation, data exfiltration, or device brick.","remediation":"Upgrade to firmware version 260403_2.0.1 or later, as the vendor has released a patched version; until then, restrict administrative access to trusted IP ranges and disable remote management if not required.","detection":"Monitor /var/log/messages or syslog for unexpected shell command invocations (e.g., lines containing 'sh ', 'bash ', 'exec ', or '/bin/ioos' with suspicious file_id arguments), and watch for outbound connections to non-standard ports from the device's IP after authentication. No reliable host or network indicator is derivable from the published description.","tags":["os-command-injection","rce","firmware","embedded","iot"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:52:00.593Z"}}