Description
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Published: 2026-11-01
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

A command injection flaw exists in the WAVLINK WN553X1‑B router within the sub_416B50 function of /bin/ioos. An attacker can manipulate the file_id argument to inject and run arbitrary operating system commands, compromising the device’s confidentiality, integrity, and availability. This issue is mapped to CWE‑77 and CWE‑78.

Affected Systems

The vulnerability affects WAVLINK WN553X1‑B routers running firmware 260403_2.0.0. No other versions are listed as affected in the CVE data.

Risk and Exploitability

The flaw carries a CVSS score of 9.4, indicating critical severity. While an EPSS score is not supplied, the attack can be carried out remotely, as noted in the description, and the exploit has been publicly disclosed. The vulnerability is not currently listed in the CISA KEV catalog. A remote attacker, accessing the router’s management interface or exposed services, can trigger the injection via the file_id parameter and obtain full control over the device.

Generated by OpenCVE AI on November 1, 2026 at 15:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the WAVLINK WN553X1‑B firmware to the latest version that removes the vulnerable sub_416B50 path in /bin/ioos.
  • If a firmware update is unavailable, restrict remote access to the router’s management interface by configuring firewall rules or enabling VLAN segmentation to allow only trusted IP addresses.
  • Disable or isolate any unused services or ports that may expose the /bin/ioos command, and monitor device logs for anomalous command execution attempts to detect exploitation attempts.

Generated by OpenCVE AI on November 1, 2026 at 15:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 01 Nov 2026 14:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Title WAVLINK WN553X1-B ioos sub_416B50 os command injection
First Time appeared Wavlink
Wavlink wn553x1-b
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:wavlink:wn553x1-b:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wn553x1-b
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Wavlink Wn553x1-b
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-01T14:00:19.852Z

Reserved: 2026-10-31T19:35:23.428Z

Link: CVE-2026-120229

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-01T14:18:53.123

Modified: 2026-11-01T14:18:53.123

Link: CVE-2026-120229

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-01T15:30:07Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')