CVE-2026-120229 WAVLINK CVE debrief

Who should care

Defenders responsible for WAVLINK WN553X1-B devices, especially those with publicly accessible interfaces, should assess their exposure and prioritize verification and potential remediation.

Why it matters

CVE-2026-120229 is a high-severity OS command injection vulnerability in WAVLINK WN553X1-B devices. Defenders should prioritize verifying exposure, especially for publicly accessible devices, and assess the feasibility of remote exploitation. The public disclosure of exploits increases the urgency for remediation.

• Remote exploitation could lead to unauthorized command execution
• Potential for lateral movement within networks
• Need for verification of device exposure and vulnerability
• Prioritization of remediation efforts based on business criticality

Technical summary

The WAVLINK WN553X1-B device, with firmware version 260403_2.0.0, contains a vulnerability in the sub_416B50 function of the /bin/ioos file, which is susceptible to OS command injection attacks via the file_id argument. This vulnerability, tracked as CVE-2026-120229, has a CVSS score of 8.5, indicating a high severity level. The vulnerability can be exploited remotely, and a public exploit has been disclosed.

Defensive priority

Defenders should prioritize verifying exposure of WAVLINK WN553X1-B devices, especially those with publicly accessible interfaces, and assess the feasibility of remote exploitation.

Recommended defensive actions

• Verify exposure of WAVLINK WN553X1-B devices, especially those with publicly accessible interfaces
• Assess the feasibility of remote exploitation
• Monitor for publicly disclosed exploits
• Consider compensating controls, such as network access restrictions
• Review vendor patch guidance for WN553X1-B devices
• Perform asset inventory of WN553X1-B devices in managed environments
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 8.5 and the CWE-77 and CWE-78 weaknesses. However, the vendor's response and specific affected versions are not detailed in the provided sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.