CVE-2026-120240：A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. Thi

A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

漏洞详情

A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.

风险评估

• CVSS 评分：8.6（HIGH）
• 评分版本：CVSS 4.0
• 攻击向量：CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

弱点类型

CWE-77、CWE-78

参考链接

• https://github.com/senxitoyshuyi-ui/HACKALL/blob/main/WAVLINK%20WN553X1-B%20Router/WAVLINK_WN553X1-B_wireguard_cli_group_command_injection.md
• https://vuldb.com/cve/CVE-2026-120240
• https://vuldb.com/submit/919251
• https://vuldb.com/vuln/429599
• https://vuldb.com/vuln/429599/cti

数据来源：NVD（美国国家漏洞数据库），入库时按 CVSS 评分筛选。

原文链接： CVE-2026-120240：A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. Thi