Critical OS Command Injection Vulnerability in WAVLINK WN553X1-B

## Overview WAVLINK has a critical vulnerability in the WN553X1-B model, specifically in the firmware version 260403_2.0.0. This flaw allows for remote command injection through improper handling of the file_id argument in the function sub_416B50 located in /bin/ioos. ## Technical Details The vulnerability, identified as CVE-2026-120229, has a CVSS score of 8.5, indicating its high severity. Attackers can exploit this vulnerability remotely, making it particularly dangerous. The flaw occurs due to insufficient validation of user input, allowing malicious commands to be executed on the device. ## Impact Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected device. This could lead to unauthorized access, data breaches, or further network compromise. Given the remote nature of the attack, the risk is heightened for users who have not secured their devices. ## Mitigation Defenders should take immediate action by updating the firmware of the WAVLINK WN553X1-B to the latest version provided by the vendor. Regularly check for updates and apply them promptly. Additionally, consider implementing network segmentation and monitoring to detect any unusual activity that may indicate exploitation attempts.