# CVE-2026-120238: WAVLINK WN553X1-B command injection in ovpn_file handler

Source: https://junglewise.ai/threats/cve-2026-120238-a-vulnerability-has-been-found-in-wavlink-wn553x1-b-260403-2-0-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120238 · Severity: critical · CVSS 9.9 · Published 2026-11-01

WAVLINK WN553X1-B routers contain a command injection vulnerability in the OpenVPN file management function that allows authenticated attackers to execute arbitrary system commands with root privileges. Since the device ships with a hardcoded default password, an attacker with network access can log in and compromise the router completely, potentially intercepting network traffic or using it as a foothold to attack connected devices.

Technologies: [Wavlink WN553X1-B](https://junglewise.ai/threats/technologies/wn553x1-b). Vendors: [Wavlink](https://junglewise.ai/threats/vendors/wavlink).

## Quick answers

**Is CVE-2026-120238 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120238 being exploited in the wild.

**How severe is CVE-2026-120238?** Critical severity, with a CVSS score of 9.9, published 1 November 2026.

**Which products and versions are affected?** Wavlink WN553X1-B 260403_2.0.0.

**Is there a fix for CVE-2026-120238?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120238 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-120238?** Check whether you run Wavlink WN553X1-B at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authenticated command injection in the ovpn_file handler (sub_4162A8 function of /bin/ioos). When a POST request with function=set and type=del is processed, the user-supplied file_id parameter is embedded into a command string passed to popen without sanitization. An attacker can break out of the quoted string with a payload like a";COMMAND;" to execute arbitrary OS commands with root privileges.

## Affected products

- WAVLINK WN553X1-B 260403_2.0.0

## Timeline

- 2026-11-01: disclosed

## References

- [https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_ovpn_file_command_injection.md](https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_ovpn_file_command_injection.md)
- [https://vuldb.com/cve/CVE-2026-120238](https://vuldb.com/cve/CVE-2026-120238)

## Related threats

- [WAVLINK WN553X1-B WireGuard command injection](https://junglewise.ai/threats/cve-2026-120240-a-vulnerability-was-determined-in-wavlink-wn553x1-b-v260403-2-0)
- [WAVLINK WN553X1-B WireGuard CLI command injection](https://junglewise.ai/threats/cve-2026-120239-a-vulnerability-was-found-in-wavlink-wn553x1-b-v260403-2-0-0)
- [WAVLINK WN553X1-B OS command injection in OpenVPN CLI handler](https://junglewise.ai/threats/cve-2026-120231-a-vulnerability-was-determined-in-wavlink-wn553x1-b-v260403-2-0)
- [WAVLINK WN553X1-B os command injection in ioos](https://junglewise.ai/threats/cve-2026-120229-a-vulnerability-has-been-found-in-wavlink-wn553x1-b-260403-2-0-0)
- [WAVLINK WN553X1-B command injection in ioos service](https://junglewise.ai/threats/cve-2026-120228-a-flaw-has-been-found-in-wavlink-wn553x1-b-v260403-2-0-0-this)