External risk intelligence

WAVLINK WN551X3-A WireGuard Command Injection Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-120344

The vulnerability affects a network device (WAVLINK router) and specifically targets the WireGuard component. VPN and remote access gateways of this type are designed to be internet-facing to facilitate remote connectivity, making the affected interface a common and intended public-facing component in normal deployment.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been publicly disclosed that allows remote attackers to execute arbitrary commands on affected WAVLINK devices. This issue stems from a flaw in the WireGuard component, specifically how it handles the 'group_name' argument, potentially enabling attackers to compromise the device's system. The exploit has been disclosed and may be actively used.

Unauthenticated remote command execution.
Affects internet-facing network devices.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by remotely sending specially crafted input to the device's WireGuard component. This input manipulates the `group_name` argument within the `ioos` file, triggering an operating system command injection flaw. Successful exploitation could allow an attacker to gain significant control over the affected device.

No authentication or special access needed.
Triggered by manipulating a command argument.
Leads to full device compromise.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in the WireGuard component of a WAVLINK router could allow remote attackers to execute arbitrary commands. This occurs when the `group_name` argument is manipulated, leading to an operating system command injection. The exploit has been publicly disclosed and may be in use.

System command execution.
Remote manipulation of arguments.
Unauthorized system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in a WAVLINK router affects the WireGuard component, potentially leading to OS command injection exploitable remotely. Infrastructure or network security teams are likely responsible for managing these devices. The first practical step is to identify all instances of this router, determine their network exposure, confirm business criticality, and locate the accountable owner to plan remediation based on risk.

Ownership: Infrastructure and network teams.
Verify: Router exposure and criticality.
Action: Plan targeted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WAVLINK WN551X3-A router?

The WAVLINK WN551X3-A is a networking device used to manage local area network connectivity and traffic. The specific firmware version M51X3_V251020-WO-182e965 includes a component called the WireGuard CLI Group Handler, which facilitates VPN-like encrypted tunneling. This device is typically deployed to bridge connections between internal networks and external or remote clients.

How does CVE-2026-120344 affect this device?

This vulnerability is classified as OS command injection (CWE-77/CWE-78). It occurs because the system fails to properly validate input provided to the 'group_name' argument within the WireGuard component. When an attacker sends a malicious string as this argument, the device incorrectly interprets it as a system command, executing it with administrative privileges.

Can this be triggered without internet access?

The vulnerability is triggered by sending specially crafted input to the WireGuard configuration interface. While local access can trigger the bug, the interface is often exposed by default. It is not triggered by standard, legitimate network traffic or normal VPN usage; it specifically requires the intentional injection of command-syntax characters into the affected argument field.

Is my device at risk based on Halo Surface Signal?

Because this router model and its WireGuard component are designed to facilitate remote connectivity, Halo Surface Signal identifies them as very likely to be internet-facing. If your device is accessible from the public internet to enable remote work or site-to-site tunnels, it is in the primary path for potential remote exploitation.

What is the first step to secure affected hardware?

Begin by auditing your environment to locate all deployed instances of the WN551X3-A router. Immediately restrict network access to these devices, ensuring they are not reachable from the public internet. Coordinate with your network or infrastructure team to verify the current configuration, identify the device owner, and prepare for official firmware updates once available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.