CVE-2026-120240: RCE in WAVLINK WN553X1-B WireGuard Handler

CVE-2026-120240 affects WAVLINK WN553X1-B firmware version V260403_2.0.0 and impacts the sub_41A748 function within the WireGuard CLI Group Handler component, accessible via /bin/ioos file. Manipulation of group_id or group_name parameters enables a remote attacker to inject operating system commands without prior authentication. The device executes commands with elevated privileges, allowing complete control of the router.

The CVSS score is 9.9 (critical), the highest on the scale. The exploit has been publicly disclosed and the research community is discussing it on social media. No patches are reported to be available yet: the vendor was contacted by the researchers, but a fix release is not yet confirmed. The vulnerability window remains open and attackers may already be exploiting it.

IT teams and administrators must act immediately: identify all WAVLINK WN553X1-B routers in production and corporate network environments. Isolate devices from the network until an official patch is released, or implement strict monitoring on /bin/ioos access logs and arguments passed to the WireGuard handler. Contact WAVLINK support to request a fix timeline and continue monitoring official vendor advisories.

In the absence of a patch, administrators can implement firewall rules to restrict access to device web management to trusted networks, disable remote access to /bin/ioos if not essential, and review system logs for traces of anomalous commands or unexpected process execution. Also verify whether the device firmware has received security updates from WAVLINK and consider router replacement if it cannot be removed from production.