CVE-2026-120345 · WAVLINK WN551X3-A DNS Resolution Handler OS command injection in…

01 · The Real Story

A public phone box with an unlocked keypad inside; anyone who finds it owns the whole street

The bug is a classic OS command injection in the DNS resolution handler (sub_41a430, /bin/ioos) of WAVLINK WN551X3-A firmware M51X3_V251020-WO-182e965. An attacker who can influence the data argument passed to this handler can inject shell metacharacters; the router executes them as root. Affected range: the cited firmware build and likely earlier builds in the same line; no patched version is published in the current notice.

Vendor severity is CRITICAL (CVSS 10). That is technically fair if the router's management or DNS proxy is reachable from the internet: no auth, no user interaction, and shell access leads to DNS/traffic hijacking. In most enterprise fleets, though, Wavlink WN551X3-A is consumer/SOHO hardware that rarely appears in managed assets, so a blanket 10 overstates real organizational risk. The exploit is public, but there is no KEV listing and no confirmed mass exploitation.

"Public unauthenticated RCE in Wavlink WN551X3-A DNS handler—critical on paper, but low enterprise exposure trims it to HIGH."

02 · The Attack Path

4 steps from start to impact.

STEP 01

Reach the WN551X3-A DNS handler from WAN or LAN

The vulnerable function sub_41a430 lives in the router's DNS resolution code (/bin/ioos). An attacker must first send traffic to the device—either a management/API request that triggers DNS resolution, or a crafted DNS query if the device runs a DNS proxy on port 53.

Conditions required:

Router has internet-facing management or DNS proxy enabled
Attacker knows or can discover the WAN IP / LAN IP
Firmware is M51X3_V251020-WO-182e965 or vulnerable older build

Where this breaks in practice:

Most consumer routers do not expose DNS proxy to WAN by default
Wavlink remote management is often disabled unless manually enabled
This model rarely appears in enterprise inventory/CMDB

Detection/coverage: Shodan/Censys queries for WAVLINK or WN551X3 can reveal exposed devices; internal asset scans should flag the model.

STEP 02

Deliver crafted data argument to the vulnerable function

The attacker sends a specially formatted request that causes the DNS handler to call sub_41a430 with an attacker-controlled data value. Because the firmware concatenates this value into a shell command without sanitization, shell metacharacters such as ;, |, or $(...) are interpreted by the OS.

Conditions required:

Attacker can influence a DNS resolution request or response processed by /bin/ioos
No filtering/escaping of shell metacharacters in this firmware build
Payload fits the expected length/encoding constraints

Where this breaks in practice:

May require controlling an upstream DNS server or performing DNS rebinding if WAN path is not available
LAN-only path requires already being on the local network
Exact packet structure needed; generic web exploit kits may not be reliable

Detection/coverage: Network IDS may see anomalous DNS queries containing shell syntax; Wavlink does not provide host-based logging.

STEP 03

Execute OS command as root

The injected command executes with the privileges of the /bin/ioos process, which on this platform runs as root. The attacker can then enable telnet/SSH, create a reverse shell, or download and execute a malicious payload.

Conditions required:

Injection succeeds
Router allows outbound connection from shell if using reverse shell
No command length or character restrictions block the payload

Where this breaks in practice:

Memory mitigations like ASLR/NX do not stop command injection
Router may have limited shell utilities but enough for persistence
Custom firmware builds may strip some busybox applets

Detection/coverage: Outbound reverse-shell connections from the router's WAN IP can be spotted by firewall egress rules; router-side detection absent.

STEP 04

Pivot from router to attached LAN or branch VPN

With root on the gateway, the attacker can alter DNS/DHCP settings, intercept cleartext traffic, inject malicious firmware, or use the router as a jump host. In a branch-office setup where the Wavlink terminates a VPN, the attacker may attempt to traverse that tunnel into the corporate network.

Conditions required:

Router is the default gateway for a populated LAN or branch office
DNS/DHCP functions are active
VPN or site-to-site tunnel configured on the router

Where this breaks in practice:

Most WN551X3-A use is home/SOHO with a handful of devices
Enterprise branch deployments are rare; if present, often isolated by L3 firewall from core
Endpoint EDR on internal clients may catch post-exploit activity

Detection/coverage: Endpoint detection for credential theft or lateral movement; NDR/SIEM alert on unusual router-to-core flows.

03 · Compensating Control

HIGH 8.3→HIGH 8.3

Inventory and identify all WN551X3-A units — Run a network asset scan for the exact model WN551X3-A and firmware build M51X3_V251020-WO-182e965. This device may not be in CMDB. If none found, document and close. noisgate mitigation SLA: HIGH → ≤ 30 days to mitigate; noisgate remediation SLA: HIGH → ≤ 180 days once vendor fix is available.

HIGH 8.3→MEDIUM 6.0

SEVERITY REDUCED

Disable WAN-side DNS and remote management — In the Wavlink admin UI, disable remote administration and ensure the DNS proxy binds only to LAN. This breaks the internet attack path; if exploitation can still occur from LAN or via malicious upstream DNS, the residual risk drops but does not disappear. noisgate mitigation SLA: HIGH → ≤ 30 days.

HIGH 8.3→LOW 3.9

SEVERITY REDUCED

Isolate WN551X3-A routers from production networks — Move these devices to a guest VLAN or separate management segment with no route to core systems, especially where they terminate site-to-site VPN. This limits post-exploit pivot. noisgate mitigation SLA: HIGH → ≤ 30 days.

HIGH 8.3→LOW 1.0

SEVERITY REDUCED

Apply vendor firmware patch when released — Track the Wavlink support page for a fixed firmware version for WN551X3-A. Once available, deploy it to all affected devices. noisgate remediation SLA: HIGH → ≤ 180 days from patch availability.

What doesn't work

A perimeter firewall alone won't stop LAN-based exploitation or malicious DNS responses if the router itself is allowed to make external DNS queries.
Disabling the web admin interface does not remediate the vulnerable /bin/ioos code path; DNS processing can still be triggered.
Generic IPS signatures are unlikely to have coverage for this specific consumer-router command injection.

04 · Intelligence Metadata

The supporting signals.

CVE ID	CVE-2026-120345
In-the-wild status	No known mass exploitation; public exploit described; not in CISA KEV as of 2026-11-02.
Proof of concept	Exploit made public per disclosure; no specific GitHub PoC repo could be verified during this assessment.
EPSS	Not available / too new. Treat as unknown; do not use for SLA.
CVSS vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` — network, low complexity, no privileges, no user interaction, scope changed. Score 10.
Affected firmware	`M51X3_V251020-WO-182e965` and likely earlier builds; no fixed build published in current notice.
Exposure	Consumer/SOHO router; internet exposure likely low. Shodan/Censys data not confirmed for this specific model.
Disclosure date	2026-11-02
Reporting researcher	Unknown; vendor contacted early per disclosure.
Weakness	CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources.

05 · The Call

Final Verdict

↓ DOWNGRADED to HIGH (8.3/10)

Why this verdict

Vendor score baseline: The CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) is technically coherent for an unauthenticated RCE chain on an exposed router. We take it as the starting point.
Role multiplier: WN551X3-A is a consumer/SOHO network edge, not an enterprise perimeter appliance. High-value branch-edge/VPN roles are plausible but likely <1% of the installed base; that caps the floor at HIGH rather than CRITICAL.
Friction adjustment 1 (exposure): Typical default configuration does not expose the DNS handler to WAN; remote unauthenticated exploitation requires a non-default setup or LAN adjacency. Remove ~1.0 from the score.
Friction adjustment 2 (installed base): This model is unlikely to appear in managed enterprise assets; the affected population is small relative to patching scope. Remove ~0.4.
Friction adjustment 3 (lack of active exploitation): Public exploit exists, but no KEV listing or mass scanning evidence. Remove ~0.3.
Adjusted score: 10.0 − 1.0 − 0.4 − 0.3 = 8.3, which is HIGH.

Why not higher?

Not CRITICAL because the affected hardware is not a common enterprise edge platform; internet exposure requires a non-default configuration; and there is no evidence of active mass exploitation or KEV inclusion. The most damaging path requires the router to terminate a site-to-site VPN into a corporate network, which is uncommon for this model.

Why not lower?

Not MEDIUM because root compromise of a network edge device is a serious outcome even in SOHO use; the exploit is public, requires no authentication or interaction, and increases urgency for anyone with affected devices. The vendor's critical rating is not an exaggeration for the vulnerable code path itself.

06 · Verification

Crowdsourced verification payload.

Run from an auditor workstation on the same network as the router, with network access to the device. Invoke as bash check_wavlink_wn551x3.sh <router_ip>; no special privileges on the target are needed, though read access to the router's admin status page is required.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# Check WAVLINK WN551X3-A firmware for CVE-2026-120345
set -euo pipefail
TARGET="${1:?usage: $0 <router-ip>}"
# Try common Wavlink sysinfo endpoints
for path in / /status.html /cgi-bin/status /cgi-bin/system_info /goform/getStatus; do
  resp=$(curl -sk --max-time 5 "${TARGET}${path}" || true)
  if echo "$resp" | grep -qi "WN551X3-A"; then
    model="WN551X3-A"
    fw=$(echo "$resp" | grep -o 'M51X3_V[0-9]*-WO-[0-9a-f-]*' | head -1 || true)
    if [ -n "$fw" ]; then
      if [ "$fw" = "M51X3_V251020-WO-182e965" ]; then
        echo "VULNERABLE: model=$model firmware=$fw"
        exit 0
      else
        echo "PATCHED: model=$model firmware=$fw"
        exit 0
      fi
    fi
  fi
done
echo "UNKNOWN: could not confirm model or firmware version. Manual check required."
exit 2