Zero Radar
← feed
CriticalVulnerabilityCVE-2026-120344updated 2 Nov 2026, 05:20 UTC

WAVLINK WN551X3-A router lets remote attackers run system commands

Attackers on the internet may be able to take control of this WAVLINK router by sending a specially crafted input. Once inside, they can run commands on the device.

NewOfficial source
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Remote attackerSends crafted group_name input over network
  2. 2Vulnerable handlerWireGuard group function in /bin/ioos
  3. 3Unsanitized argumentgroup_name passed to system call
  4. 4Commands executedInjected OS commands run on device
  5. ResultAttacker controls the router

What happened

The WireGuard CLI Group Handler in /bin/ioos on WAVLINK WN551X3-A firmware M51X3_V251020-WO-182e965 does not sanitize the group_name argument, allowing OS command injection remotely.

Why it is dangerous: A remote attacker could fully control the router, potentially intercepting or redirecting traffic for everyone on the network. Anyone running this device with remote access exposure is at risk.

Are you affected?

You are affected if you run WAVLINK WN551X3-A with firmware M51X3_V251020-WO-182e965 and use its WireGuard VPN group configuration features.

WAVLINK WN551X3-A, firmware M51X3_V251020-WO-182e965

What to do

  1. Check the router's firmware version and confirm whether it matches M51X3_V251020-WO-182e965
  2. Restrict or disable remote administration access to the router until a fix is available
  3. Check the vendor's site for a firmware update and apply it as soon as one is released

Timeline

  1. 2 Nov 2026, 05:18 UTC
    Publicly disclosed
  2. 2 Nov 2026, 05:18 UTC
    Reported by NVD · NVD
  3. 2 Nov 2026, 05:20 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-120344
CVSS
9.3 / 10
Disclosed
2 Nov 2026, 05:18 UTC
On Zero Radar
2 Nov 2026, 05:20 UTC (2 min after disclosure)
Last change
2 Nov 2026, 05:20 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WAVLINK WN551X3-A router lets remote attackers run system commands · Zero Radar