CVE-2026-120322
CriticalCVSS 9.9Summary
A vulnerability was identified in Termix-SSH Termix up to 2.9.2 affecting the /plugin-api/file-manager/transferToHost endpoint. Manipulation of the destPath argument leads to path traversal, and the attack can be launched remotely. The exploit is publicly available and may be used.
Risk Assessment
An attacker could remotely write files outside the intended directory, potentially overwriting system files or achieving code execution. The risk is high because the exploit is public.
Recommendation
Upgrade the File Manager plugin to version 1.0.0 or later and the core to version 26.10.0, where the vulnerable path was removed. Until then, restrict access to the transferToHost endpoint.
Related vulnerabilities
- CVE-2026-120283Critical
A vulnerability was identified in Linksys E8450 version 1.2.00.360516 in the strcpy function of /www/cgi-bin/portal.cgi. Manipulation of the hidden_timezone argument leads to a stack-based buffer overflow. The attack can be executed remotely, and the vendor did not respond to the disclosure.
- CVE-2026-120282Critical
A vulnerability was determined in WAVLINK WN536AX6-A version V260507 in the host_black function of /protocol.csp. Manipulation of the mac argument causes OS command injection. The exploit has been publicly disclosed and remote exploitation is possible.
- CVE-2026-120281Critical
A vulnerability was found in WAVLINK WN536AX6-A version V260507 in the OpenVPN Handler component, in the strcpy function of /protocol.csp. Manipulation of the openvpn_ip argument results in a stack-based buffer overflow. The exploit has been made public and the attack may be launched remotely.
- CVE-2026-120280Critical
A vulnerability has been found in WAVLINK WN536AX6-A version V260507 in the WireGuard component, in the wireguard_cli_group handler of /protocol.csp. Manipulation of the group_id/group_name arguments leads to OS command injection. The exploit has been disclosed publicly and the attack may be initiated remotely.
- CVE-2026-120279Critical
A flaw has been found in WAVLINK WN536AX6-A version V260507 in the openvpn_cli Handler component, in an unknown function of /protocol.csp. Manipulation of the file_id argument can lead to OS command injection. The exploit has been published and the attack can be launched remotely.
- CVE-2026-120277Critical
A vulnerability was detected in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_41a1d8 function of the /bin/ioos file, related to the WireGuard CLI group handler. Manipulation of the group_name argument leads to OS command injection. The issue can be exploited remotely and a public exploit is already available.
- CVE-2026-120276Critical
A weakness was identified in WAVLINK WN536AX6-A (version V260507_2.0.0) in the sub_416760 function of the /bin/ioos file, within the web management interface component. Manipulation of the group_name argument causes OS command injection. The attack can be initiated remotely and the exploit has been made publicly available.
- CVE-2026-120240Critical
A vulnerability was found in the WAVLINK WN553X1-B device (version V260403_2.0.0) in the sub_41A748 function of /bin/ioos, part of the WireGuard CLI Group Handler. Manipulating the group_id/group_name arguments can lead to OS command injection. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-120239Critical
A vulnerability was found in WAVLINK WN553X1-B (V260403_2.0.0) in the sub_419DA8 function of /bin/ioos, within the WireGuard CLI Handler component. Manipulating the file_id argument leads to OS command injection. The attack can be carried out remotely and the exploit has been made public.
- CVE-2026-120238Critical
A vulnerability has been found in WAVLINK WN553X1-B (260403_2.0.0) in the sub_4162A8 function of /bin/ioos, within the ovpn_file Handler component. Manipulating the file_id argument leads to OS command injection. The attack can be executed remotely and the exploit has been disclosed to the public.
Original NVD description (English source)
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. The shortcut was removed in the standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and in core v26.10.0. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS