Description
A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Published: 2026-11-02
Score: 10 Critical
EPSS: n/a
KEV: No
Impact: Remote Operating System Command Execution
Action: Apply Fix
AI Analysis

Impact

The vulnerability resides in the sub_41a430 function used by the DNS Resolution Handler (file /bin/ioos). Manipulating the argument data triggers an OS command injection, allowing an attacker to execute arbitrary commands on the router's operating system. The weakness corresponds to CWE-77 and CWE-78, which can compromise confidentiality, integrity, and availability of the device and any connected network resources.

Affected Systems

Known affected product is WAVLINK WN551X3-A, firmware build M51X3_V251020-WO-182e965. The vulnerability is present in the specified function; no other versions are specified but any firmware containing the same code path may be impacted.

Risk and Exploitability

The CVSS base score is 10, indicating critical severity. The EPSS score is not available, but the vulnerability is publicly documented and could be leveraged remotely. It is not listed in the CISA KEV catalog, yet the public disclosure suggests that attackers could feasibly exploit the weakness. The attack requires remote ability to send crafted argument data to /bin/ioos, implying that the router is exposed to an untrusted network or that the attacker can reach the DNS Resolution Handler directly.

Generated by OpenCVE AI on November 2, 2026 at 06:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Deploy the latest firmware update from WAVLINK that removes the vulnerable function or applies proper input validation for DNS query handling.
  • Restrict remote access to the router by configuring firewall rules or access control lists so that only trusted networks can reach the DNS Resolution Handler.
  • If an update is unavailable, disable or block the DNS resolution service or the specific port(s) used by /bin/ioos to prevent remote calls to the vulnerable function.

Generated by OpenCVE AI on November 2, 2026 at 06:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 05:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Title WAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection
First Time appeared Wavlink
Wavlink wn551x3-a
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:a:wavlink:wn551x3-a:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wn551x3-a
References
Metrics cvssV2_0

{'score': 10, 'vector': 'AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 10, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Wavlink Wn551x3-a
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-02T05:15:16.333Z

Reserved: 2026-11-01T15:49:01.470Z

Link: CVE-2026-120345

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-02T06:17:43.410

Modified: 2026-11-02T06:17:43.410

Link: CVE-2026-120345

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T06:30:06Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')