{"id":"CVE-2026-120238","published":"2026-11-01T18:17:13.720","lastModified":"2026-11-01T18:17:13.720","description":"A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_ovpn_file_command_injection.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120238","tags":[]},{"url":"https://vuldb.com/submit/919248","tags":[]},{"url":"https://vuldb.com/vuln/429597","tags":[]},{"url":"https://vuldb.com/vuln/429597/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_ovpn_file_command_injection.md","tags":[]}],"hasPoc":true,"ai":{"summary":"The WAVLINK WN553X1-B firmware v260403_2.0.0 contains an OS command injection vulnerability in the /bin/ioos binary's sub_4162A8 function, triggered by unsanitized user input passed as file_id to the ovpn_file handler, allowing remote authenticated attackers to execute arbitrary commands on the device.","exploitability":"Exploitation requires low-privilege network access (PR:L) with no user interaction needed (UI:N), and a publicly available exploit exists.","blast_radius":"Successful exploitation grants full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) on the affected device, potentially enabling lateral movement within the internal network or persistent backdoor access.","remediation":"Upgrade to firmware version 260403_2.0.1 or later, as the vendor has released a patched version; until then, disable remote OpenVPN file management functionality and restrict access to the /bin/ioos endpoint to trusted internal IPs only.","detection":"Look for HTTP POST requests to the OpenVPN file upload endpoint containing suspicious file_id parameters with shell metacharacters (e.g., ';', '|', '$(') or unexpected command sequences in web server or application logs; also monitor for spawned /bin/ioos processes executing non-standard arguments.","tags":["os-command-injection","rce","vpn","embedded-device","authenticated"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:49:48.932Z"}}