# CVE-2026-120239: WAVLINK WN553X1-B WireGuard CLI command injection

Source: https://junglewise.ai/threats/cve-2026-120239-a-vulnerability-was-found-in-wavlink-wn553x1-b-v260403-2-0-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120239 · Severity: critical · CVSS 9.9 · Published 2026-11-01

The WAVLINK WN553X1-B router contains a command injection flaw in its WireGuard configuration handler that allows authenticated attackers to execute arbitrary commands with root privileges. While authentication is normally required, the device ships with a default password that is difficult to change, making remote compromise trivial for attackers. Successful exploitation grants full control of the device, enabling data theft, network monitoring, or use as a pivot point for further attacks.

Technologies: [Wavlink WN553X1-B](https://junglewise.ai/threats/technologies/wn553x1-b). Vendors: [Wavlink](https://junglewise.ai/threats/vendors/wavlink).

## Quick answers

**Is CVE-2026-120239 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120239 being exploited in the wild.

**How severe is CVE-2026-120239?** Critical severity, with a CVSS score of 9.9, published 1 November 2026.

**Which products and versions are affected?** Wavlink WN553X1-B V260403_2.0.0.

**Is there a fix for CVE-2026-120239?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120239 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-120239?** Check whether you run Wavlink WN553X1-B at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the sub_419DA8 function of /bin/ioos, where the file_id parameter in the WireGuard CLI handler is passed unsanitized to popen() via a snprintf call. An attacker can break out of double quotes using a payload like a";COMMAND;" to inject arbitrary OS commands executed as root. Authentication is required but can be bypassed using the hardcoded factory-default credential admin, and the exploit has been publicly disclosed with working proof-of-concept code.

## Affected products

- WAVLINK WN553X1-B V260403_2.0.0

## Timeline

- 2026-11-01: disclosed: CVE-2026-120239 published

## References

- [https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_command_injection.md](https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_command_injection.md)
- [https://vuldb.com/cve/CVE-2026-120239](https://vuldb.com/cve/CVE-2026-120239)

## Related threats

- [WAVLINK WN553X1-B WireGuard command injection](https://junglewise.ai/threats/cve-2026-120240-a-vulnerability-was-determined-in-wavlink-wn553x1-b-v260403-2-0)
- [WAVLINK WN553X1-B command injection in ovpn_file handler](https://junglewise.ai/threats/cve-2026-120238-a-vulnerability-has-been-found-in-wavlink-wn553x1-b-260403-2-0-0)
- [WAVLINK WN553X1-B OS command injection in OpenVPN CLI handler](https://junglewise.ai/threats/cve-2026-120231-a-vulnerability-was-determined-in-wavlink-wn553x1-b-v260403-2-0)
- [WAVLINK WN553X1-B os command injection in ioos](https://junglewise.ai/threats/cve-2026-120229-a-vulnerability-has-been-found-in-wavlink-wn553x1-b-260403-2-0-0)
- [WAVLINK WN553X1-B command injection in ioos service](https://junglewise.ai/threats/cve-2026-120228-a-flaw-has-been-found-in-wavlink-wn553x1-b-v260403-2-0-0-this)