Three Command Injection CVEs Affect WAVLINK WN553X1-B

Three published CVE records describe OS command injection flaws in the WAVLINK WN553X1-B router. CVE-2026-120238, CVE-2026-120239 and CVE-2026-120240 all identify firmware 260403_2.0.0 as affected. The records use a leading “V” for the last two version strings; they otherwise identify the same model and version number.

VulDB, the CVE numbering authority behind these records, assigns each flaw a CVSS 3.1 score of 9.9 (Critical). The vectors require low privileges, with network access and no user interaction. That distinction matters: these records do not describe an unauthenticated route into the router. The scores are from the CNA records, not an independent NVD assessment.

Three affected functions

The records place one flaw in an OpenVPN file handler and two in WireGuard handlers. In each case, the CNA says crafted input can reach an OS command injection path. The same source says public exploits have been disclosed, but does not establish exploitation in the wild. We are omitting request details and payloads because administrators do not need them to assess exposure.

The affected version is specific in the published records. They do not establish that every WN553X1-B firmware release is vulnerable, and they do not provide a fixed release. The records say the vendor was contacted, but do not link to a WAVLINK advisory or patch. No patch status should be inferred from the CVSS score.

What to check

Administrators with a WN553X1-B should identify its installed firmware version and check WAVLINK’s support channel for an update or vendor guidance. Limit access to the router’s management interface to trusted users and networks while assessing the issue. This is exposure reduction, not a confirmed fix. A firmware version other than 260403_2.0.0 should be evaluated against vendor guidance rather than assumed safe from these records alone.

The three CVE Program records are the current primary source for affected version, scope and score. We will update this report if WAVLINK publishes an advisory or confirms a fixed firmware release.