CVE-2026-120345
CriticalCVSS 10.0Summary
A vulnerability was found in the WAVLINK WN551X3-A device, affecting the sub_41a430 function in /bin/ioos within the DNS Resolution Handler component. Manipulating the data argument results in OS command injection, and the attack can be launched remotely. The exploit has been made public and could be used.
Risk Assessment
A remote attacker could execute arbitrary OS commands on the device and take full control of it. Since the exploit is public, the risk of rapid exploitation is high.
Recommendation
Update the device firmware to the vendor-patched version as soon as possible, or restrict access to the management interface and isolate the device on the network.
Other vulnerabilities in WAVLINK WN551X3-A
Original NVD description (English source)
A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS