{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wn553x1-b-260403_2.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wavlink:wn553x1_b:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-120231"},{"cvss":9.9,"id":"CVE-2026-120238"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WN553X1-B (V260403_2.0.0)","WN553X1-B (260403_2.0.0)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WAVLINK"],"content_html":"\u003cp\u003eA vulnerability (CVE-2026-120231) has been identified in WAVLINK WN553X1-B firmware version V260403_2.0.0. The flaw is located in the function 'sub_416568' of the file '/bin/ioos' within the OpenVPN CLI Handler component. Manipulation of the 'file_id' argument results in OS command injection. The attack can be initiated remotely. Publicly disclosed exploit code exists and may be utilized. The vendor was contacted early regarding this disclosure.\u003c/p\u003e\n","date_modified":"2026-11-01T18:56:52Z","date_published":"2026-11-01T16:57:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-wavlink-rce-df64a306/","summary":"A vulnerability in the OpenVPN CLI Handler component of the WAVLINK WN553X1-B (firmware V260403_2.0.0) allows remote OS command injection via the 'file_id' argument.","title":"WAVLINK WN553X1-B: OS command injection (CVE-2026-120231)","url":"https://feed.craftedsignal.io/briefs/2026-11-wavlink-rce-df64a306/"}],"language":"en","title":"CraftedSignal Threat Feed - WN553X1-B (260403_2.0.0)","version":"https://jsonfeed.org/version/1.1"}