Wavlink WN551X3-A: Remote OS Command Injection (CVE-2026-120345)
A critical OS command injection vulnerability in the DNS Resolution Handler of Wavlink WN551X3-A allows unauthenticated remote attackers to execute arbitrary commands via the data argument, with a public proof-of-concept exploit now available.
CVE search metadata
CVE search record: CVE-2026-120345. Severity: critical. CVSS: 10.0. KEV: no. Product: WN551X3-A (M51X3_V251020-WO-182e965). Brief: Wavlink WN551X3-A: Remote OS Command Injection (CVE-2026-120345). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-120345/
CVE search record: CVE-2026-120344. Severity: critical. CVSS: 10.0. KEV: no. Product: WN551X3-A (M51X3_V251020-WO-182e965). Brief: Wavlink WN551X3-A: Remote OS Command Injection (CVE-2026-120345). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-120345/
Triage facts
Revision 1- Applicability
- WN551X3-A (M51X3_V251020-WO-182e965)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 8 public sources
- Freshness
- Revision 1Nov 2, 08:30 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- B2Likely
What's new
- 1. added coverage for WN551X3-A (M51X3_V251020-WO-182e965) Nov 2, 08:30 via sploitus
CVE-2026-120345 is a remote OS command injection vulnerability in the DNS Resolution Handler (function sub_41a430 in /bin/ioos) of the Wavlink WN551X3-A router (specifically firmware version M51X3_V251020-WO-182e965). The vulnerability can be triggered by sending a maliciously crafted 'data' argument to the DNS resolution function. As the vulnerability is unauthenticated and a proof-of-concept exploit is publicly available, the risk to exposed devices is high.
Impact
Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands with the privileges of the DNS resolution service on the affected router. This can lead to full device compromise, persistence, and potential pivot points into internal networks.
Recommendation
- Immediately inventory and restrict internet access to Wavlink WN551X3-A routers.
- Implement network segmentation to isolate these devices from critical infrastructure.
- Monitor logs for unusual traffic targeting router administrative or DNS management interfaces.
- Contact the vendor regarding availability of firmware updates for the affected model and version.
Immediate actions
Restrict inbound access to WN551X3-A management/DNS endpoints from untrusted networks.
Inventory and isolate WAVLINK WN551X3-A routers until patches are verified.
Threat Hunt
Inspect device logs or network traffic for anomalous payload strings in DNS resolution or data arguments.
Data: Router system/audit logs, Network traffic (WAF/IDS) capturing HTTP/DNS traffic to the device
Monitor router management logs for unexpected system calls or command inputs containing shell metacharacters.
Data: Router system logs, NetFlow / Firewall logs for management interface access
Mitigations
Disable exposure of the device to the public internet.
CVE-2026-120345