Description
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Published: 2026-11-02
Score: 10 Critical
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an OS command‑injection flaw in the /bin/ioos component of the WireGuard CLI Group Handler on WAVLINK WN551X3‑A routers. By supplying an unsanitized group_name argument, an attacker can inject arbitrary shell commands, which the firmware executes with system privileges. The flaw is classified as CWE‑77 and CWE‑78 and enables remote code execution.

Affected Systems

Model WN551X3‑A, firmware version M51X3_V251020‑WO‑182e965. The affected component is the system file /bin/ioos used by the WireGuard CLI Group Handler. No other products or versions are listed in the CNA data.

Risk and Exploitability

The CVSS score of 10 marks this as a critical vulnerability. EPSS is not available, so the exact exploitation probability is unknown, but the flaw can be triggered remotely and the exploit has been publicly disclosed, indicating that attackers could possibly use it. The vulnerability is not yet listed in the CISA KEV catalog. Given the remote nature of the attack and the severity, the risk to any network that has the device exposed, especially to the Internet, is very high.

Generated by OpenCVE AI on November 2, 2026 at 06:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply an official firmware upgrade that removes the vulnerable /bin/ioos handler or disables the WireGuard CLI Group feature.
  • If a patch is not available, block or restrict remote access to the WireGuard CLI Group handler by disabling the service or limiting it to trusted IP addresses.
  • Monitor the device for unexpected command execution or anomalous activity in the WireGuard CLI Group logs and investigate immediately.

Generated by OpenCVE AI on November 2, 2026 at 06:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 05:15:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.
Title WAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection
First Time appeared Wavlink
Wavlink wn551x3-a
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:wavlink:wn551x3-a:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wn551x3-a
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Wavlink Wn551x3-a
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-02T05:00:18.872Z

Reserved: 2026-11-01T15:48:57.903Z

Link: CVE-2026-120344

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-02T05:18:25.450

Modified: 2026-11-02T05:18:25.450

Link: CVE-2026-120344

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T06:30:06Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')