Cpe:2.3:a:wavlink:wn551x3_a:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3awavlinkwn551x3_a/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 08:30:06 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWavlink WN551X3-A: Remote OS Command Injection (CVE-2026-120345)https://feed.craftedsignal.io/briefs/2026-11-cve-2026-120345/Mon, 02 Nov 2026 08:30:06 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-120345/A critical OS command injection vulnerability in the DNS Resolution Handler of Wavlink WN551X3-A allows unauthenticated remote attackers to execute arbitrary commands via the data argument, with a public proof-of-concept exploit now available.CVE-2026-120345 is a remote OS command injection vulnerability in the DNS Resolution Handler (function sub_41a430 in /bin/ioos) of the Wavlink WN551X3-A router (specifically firmware version M51X3_V251020-WO-182e965). The vulnerability can be triggered by sending a maliciously crafted 'data' argument to the DNS resolution function. As the vulnerability is unauthenticated and a proof-of-concept exploit is publicly available, the risk to exposed devices is high.

Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands with the privileges of the DNS resolution service on the affected router. This can lead to full device compromise, persistence, and potential pivot points into internal networks.

Recommendation

  • Immediately inventory and restrict internet access to Wavlink WN551X3-A routers.
  • Implement network segmentation to isolate these devices from critical infrastructure.
  • Monitor logs for unusual traffic targeting router administrative or DNS management interfaces.
  • Contact the vendor regarding availability of firmware updates for the affected model and version.
]]>criticaladvisorycve-2026-120344vulnerabilityrouterrce