{"id":"CVE-2026-120345","published":"2026-11-02T06:17:43.410","lastModified":"2026-11-02T06:17:43.410","description":"A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN551X3-A%20Router/WAVLINK_WN551X3-A_dns_resolution_command_injection.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120345","tags":[]},{"url":"https://vuldb.com/submit/919579","tags":[]},{"url":"https://vuldb.com/vuln/429670","tags":[]},{"url":"https://vuldb.com/vuln/429670/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK_WN551X3-A%20Router/WAVLINK_WN551X3-A_dns_resolution_command_injection.md","tags":[]}],"hasPoc":true,"ai":{"summary":"The WAVLINK WN551X3-A device's DNS Resolution Handler contains an OS command injection vulnerability in the sub_41a430 function of /bin/ioos, where unsanitized user-supplied data passed as a DNS argument allows remote attackers to execute arbitrary OS commands.","exploitability":"Exploitation is trivial for remote attackers as it requires no authentication, user interaction, or special conditions; the public exploit confirms low effort to reproduce.","blast_radius":"Successful exploitation grants full system compromise (confidentiality, integrity, and availability) with network-level access, enabling complete device takeover and potential pivot into internal networks.","remediation":"Upgrade to firmware version M51X3_V251020-WO-182e965-patched or later if available; until then, disable DNS resolution functionality or isolate the device from untrusted networks, as no fixed version is explicitly named in the description beyond the vulnerable build.","detection":"Look for unexpected subprocess execution of /bin/ioos with suspicious command-line arguments (e.g., shell metacharacters like ';', '|', '$(') in system logs or process monitoring; alternatively, monitor for outbound DNS queries containing encoded command payloads or anomalous network traffic to non-DNS ports from the device.","tags":["os-command-injection","rce","dns","embedded-device","iot","network-service"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:47:11.538Z"}}