CVE-2026-120239: OS Command Injection in WAVLINK WN553X1-B

CVE-2026-120239 identifies a critical OS command injection vulnerability in WAVLINK WN553X1-B device running version V260403_2.0.0. The flaw resides in the /bin/ioos file, within the WireGuard CLI Handler component, where manipulation of the file_id argument enables remote execution of arbitrary operating system commands. All administrators with WAVLINK WN553X1-B devices in production must treat this as an immediate threat.

The CVSS score is 9.9, rated critical—the highest risk level. The exploit has been made public and could be weaponized by threat actors. WAVLINK vendor was contacted early about the disclosure, but no official patch is currently available. Initial signals of discussion about the vulnerability have been detected on social media channels.

For defense, administrators must isolate WAVLINK WN553X1-B devices from the network if not mission-critical, restrict remote access channels, and actively monitor traffic to /bin/ioos to detect exploitation attempts. Contact WAVLINK immediately to request patch status and deploy it as soon as available. Alternatively, evaluate replacement with hardware from vendors with a stronger security track record.