WAVLINK WN553X1-B WireGuard Group Command Injection
Command injection in a WireGuard group handler affects WAVLINK WN553X1-B firmware V260403_2.0.0. The CNA assigns CVSS 3.1 9.9.
- Vendor
- WAVLINK
- Product
- WN553X1-B
- CVSS
- 9.9
- EPSS (exploit probability)
- N/A
- Status
- unpatched
- Published
Is CVE-2026-120240 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-120240 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-01 snapshot. That can change quickly; check the write-up below for the latest reporting.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-01. Full cross-catalog view: /kev-comparison
CVE-2026-120240 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
The published CVE record identifies OS command injection in a WireGuard CLI group handler on firmware V260403_2.0.0. Its CNA assigns CVSS 3.1 9.9 (Critical) and a vector requiring low privileges. The record says a public exploit exists, but does not document exploitation in the wild or a fixed firmware release.
Check the router’s installed firmware and seek current guidance from WAVLINK. Restrict management access to trusted users and networks while evaluating exposure.
Other WAVLINK CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-120239 WAVLINK WN553X1-B WireGuard Handler Command Injectionwrite-up | [ CRITICAL ] | 9.9 | — | — |
| CVE-2026-120238 WAVLINK WN553X1-B OpenVPN Handler Command Injectionwrite-up | [ CRITICAL ] | 9.9 | — | — |
