Is CVE-2026-120239 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120239 being exploited in the wild.

How severe is CVE-2026-120239?

Critical severity, with a CVSS score of 9.9, published 1 November 2026.

Which products and versions are affected?

Wavlink WN553X1-B V260403_2.0.0.

Is there a fix for CVE-2026-120239?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-120239 attacked?

It is attacked over the network, in device firmware.

Am I affected by CVE-2026-120239?

Check whether you run Wavlink WN553X1-B at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120239: WAVLINK WN553X1-B WireGuard CLI command injection

CVE-2026-120239 · Severity: critical · CVSS 9.9 · Published 2026-11-01

The WAVLINK WN553X1-B router contains a command injection flaw in its WireGuard configuration handler that allows authenticated attackers to execute arbitrary commands with root privileges. While authentication is normally required, the device ships with a default password that is difficult to change, making remote compromise trivial for attackers. Successful exploitation grants full control of the device, enabling data theft, network monitoring, or use as a pivot point for further attacks.

Technologies: Wavlink WN553X1-B. Vendors: Wavlink.

Quick answers

Is CVE-2026-120239 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120239 being exploited in the wild.
How severe is CVE-2026-120239?: Critical severity, with a CVSS score of 9.9, published 1 November 2026.
Which products and versions are affected?: Wavlink WN553X1-B V260403_2.0.0.
Is there a fix for CVE-2026-120239?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-120239 attacked?: It is attacked over the network, in device firmware.
Am I affected by CVE-2026-120239?: Check whether you run Wavlink WN553X1-B at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the sub_419DA8 function of /bin/ioos, where the file_id parameter in the WireGuard CLI handler is passed unsanitized to popen() via a snprintf call. An attacker can break out of double quotes using a payload like a";COMMAND;" to inject arbitrary OS commands executed as root. Authentication is required but can be bypassed using the hardcoded factory-default credential admin, and the exploit has been publicly disclosed with working proof-of-concept code.

Affected products

WAVLINK WN553X1-B V260403_2.0.0

Timeline

2026-11-01: disclosed: CVE-2026-120239 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.