CRITICAL

CVE-2026-120238

Published 2026-11-01 CVSS v3.1

View on NVD View on MITRE Check if this affects your version

CVSS Score

9.9

Description

A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

Weakness Classification (CWE)

CWE-77 Command Injection

CWE-78 OS Command Injection

References

https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_ovpn_file_command_injection.md https://vuldb.com/cve/CVE-2026-120238 https://vuldb.com/submit/919248 https://vuldb.com/vuln/429597 https://vuldb.com/vuln/429597/cti

Primary Sources

Always verify findings against the primary CVE record before acting. Both sources below are public-domain and authoritative.

NVD — NIST Official CVE enrichment, CVSS, CPE

MITRE CVE Program Official CVE record of authority

Does this affect your version?

Use the CVE Detector to check if a specific product version is impacted by this vulnerability, along with 100+ other CVEs.

Open Detector

Back to CVE Dashboard Search Other CVEs

CVE data aggregated from the National Vulnerability Database (NVD, public domain) and enriched by dbcve.org.