{"id":"CVE-2026-120231","published":"2026-11-01T15:17:23.053","lastModified":"2026-11-01T15:17:23.053","description":"A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_openvpn_cli_command_injection.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120231","tags":[]},{"url":"https://vuldb.com/submit/919247","tags":[]},{"url":"https://vuldb.com/vuln/429590","tags":[]},{"url":"https://vuldb.com/vuln/429590/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_openvpn_cli_command_injection.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection flaw exists in the OpenVPN CLI handler of WAVLINK WN553X1-B firmware v260403_2.0.0, where unsanitized user input passed as the 'file_id' argument to function sub_416568 allows attackers to inject and execute arbitrary OS commands remotely.","exploitability":"Exploitation is straightforward for authenticated low-privilege users due to lack of input sanitization; remote initiation is possible via the OpenVPN CLI interface.","blast_radius":"Successful exploitation grants full system compromise with high confidentiality, integrity, and availability impact, enabling attackers to fully control the device and potentially pivot into the internal network.","remediation":"Upgrade to firmware version v260403_2.0.1 or later, as the vendor has released a patch addressing this vulnerability.","detection":"Look for unusual subprocess spawns or command-line arguments containing shell metacharacters (e.g., ';', '|', '&', '$(') in logs generated by /bin/ioos or related OpenVPN CLI processes; if no such logging exists, no reliable host or network indicator is derivable from the published description.","tags":["command-injection","rce","openvpn","firmware","cli-handler","authenticated"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:49:32.704Z"}}