CVE-2026-120231: Command Injection in WAVLINK VPN Router

CVE-2026-120231 is a command injection vulnerability in the WAVLINK WN553X1-B router version V260403_2.0.0, detected in the OpenVPN CLI Handler component, function sub_416568 in file /bin/ioos. The file_id argument can be manipulated to inject operating system commands. The vulnerability affects VPN routers used in corporate and administrative networks, exposing them to unauthorized remote access.

The vulnerability is classified as critical with a CVSS score of 9.9. The current state is critical: the exploit has been publicly disclosed and made available. According to official data, the vendor was contacted early but no official patch has been released yet. Social media signals (2 posts in the last 24 hours) confirm community attention regarding the lack of mitigations.

Defenders must immediately identify which WAVLINK WN553X1-B routers and OpenVPN CLI components are in use at their sites. We recommend: (1) verify deployed versions in production; (2) isolate affected devices from critical networks if possible; (3) monitor access logs to OpenVPN services for anomalous activity; (4) contact WAVLINK vendor for patch or workaround information; (5) plan immediate deployment of the patch once released.