# CVE-2026-120240: CVE-2026-120240

Status: published. Published: 2026-11-01. Updated: 2026-11-01.

A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CVSS 4.0: 8.6 (high); CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: cna@vuldb.com

- CVSS 3.1: 9.9 (critical); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; source: NVD: cna@vuldb.com

- CVSS 2.0: 9 (high); AV:N/AC:L/Au:S/C:C/I:C/A:C; source: NVD: cna@vuldb.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-77

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_group_command_injection.md (cna@vuldb.com)

- https://vuldb.com/cve/CVE-2026-120240 (cna@vuldb.com)

- https://vuldb.com/submit/919251 (cna@vuldb.com)

- https://vuldb.com/vuln/429599 (cna@vuldb.com)

- https://vuldb.com/vuln/429599/cti (cna@vuldb.com)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-120240; retrieved 2026-11-02; source updated 2026-11-01

Revision: f124949f426b49454b7b2d28710c994f5193e6052bc431e54a6e058f4e2912f7

Canonical: https://y2.dev/cve/CVE-2026-120240