CVE-2026-120345: WAVLINK WN551X3-A (Critical, CVSS 9.3)

CVE record · updated Nov 2, 2026

CVE-2026-120345CriticalWAVLINK WN551X3-A

CVSS: 9.3 Critical (v4.0)
Exploited in the wild: Not on CISA’s KEV list
Public exploit: None reported in public exploit databases
Weakness: CWE-77, CWE-78
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Published: Nov 2, 2026

What it is

A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

Description from the National Vulnerability Database.

What to do

Check whether you run WAVLINK WN551X3-A, then apply the vendor’s fix or mitigation from the advisories below.

Sources: NVD, FIRST EPSS, CISA KEV, and public exploit databases (availability only). ThreatRoundup reports whether public exploit code exists but never links to it: fake proof-of-concepts that infect security researchers are common. This page updates automatically.