CVE-2026-120229: Critical Command Injection in WAVLINK Routers

CVE-2026-120229 identifies a command injection vulnerability in WAVLINK WN553X1-B router version 260403_2.0.0. The flaw resides in the sub_416B50 function of the /bin/ioos binary: an unvalidated parameter (file_id) allows a remote attacker to inject arbitrary system commands and achieve code execution on the device. This router is widely deployed in small and medium-sized enterprises, making the risk concrete for critical network infrastructure.

The CVSS score is 9.1, classified as critical. The exploit has been publicly disclosed and the vendor was notified in advance of the disclosure. Initial signals on X confirm news circulation among security researchers, though volume remains limited (1 post in the last 24 hours with 3 total interactions). Public disclosure represents a high-risk factor: public availability of the exploit significantly increases the window of opportunity for those seeking to exploit unpatched devices.

IT teams and network administrators must act promptly. First, immediately inventory all WAVLINK WN553X1-B devices in use, verifying in particular those running version 260403_2.0.0. Check the official WAVLINK website for patch availability. Until the fix is deployed, monitor error rates in /bin/ioos, restrict remote access to the device where possible, and consider temporary offline placement of critical units if the risk cannot be mitigated otherwise.