Vulnerability record/PUBLISHED/Published Nov 1, 2026 14:45:17 UTC
CVE-2026-120231
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.
Base score9.4/ 10
SeverityCriticalCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityCritical
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsNoneAT
Privileges requiredLowPR
User interactionNoneUI
Vulnerable system confidentialityHighVC
Vulnerable system integrityHighVI
Vulnerable system availabilityHighVA
Subsequent system confidentialityHighSC
Subsequent system integrityHighSI
Subsequent system availabilityHighSA
Exploit maturityProof of conceptE
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:PCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulDB
Last updatedNov 1, 2026 14:45:17 UTC
PublishedNov 1, 2026 14:45:17 UTC
ReservedOct 31, 2026 19:35:30 UTC
Credits
- shuyi (VulDB User)
- VulDB CNA Team