External risk intelligence

WAVLINK WN551X3-A DNS Resolution Handler OS Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-120345

The affected product is a consumer router (WAVLINK WN551X3-A). Vulnerabilities in DNS resolution handlers on edge devices are inherently exposed to the public internet because these devices are designed to act as internet gateways, often processing external requests and traffic directly at the network edge.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WAVLINK router that allows remote attackers to inject operating system commands by manipulating arguments in its DNS resolution function. This issue is significant because the exploit has been publicly disclosed and could potentially be leveraged by malicious actors.

Remote attackers can run commands on affected routers.
It is a public exploit affecting internet-facing devices.
Confirm relevance and exposure to consumer routers.

Attack Path

How an attacker could exploit the issue

An attacker can remotely trigger this vulnerability by manipulating the arguments passed to the DNS Resolution Handler. This handler, specifically the `sub_41a430` function within the `/bin/ioos` file, is susceptible to command injection when processing malformed data. Successful exploitation could allow an attacker to execute arbitrary commands on the affected device.

Attacker can initiate attack remotely.
Vulnerable component is DNS Resolution Handler.
Risk is operating system command injection.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability allows for operating system command injection by manipulating arguments in the DNS resolution handler. An attacker can exploit this remotely when the affected function is engaged.

Device commands and configuration.
Remote, unauthenticated network access.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given the nature of the vulnerability in a consumer router's DNS resolution handler, likely responsible teams include network infrastructure, security operations, and potentially vendor management if a managed service is in place. The first practical step is to inventory all instances of this specific router model, confirm their internet exposure and business criticality, identify the accountable owner for each device, and then prioritize remediation based on risk.

Network and Security teams own the issue.
Verify internet-facing router instances first.
Plan phased deployments for updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WAVLINK WN551X3-A and its role in a network?

The WAVLINK WN551X3-A is a consumer-grade wireless router. It serves as an internet gateway, managing network traffic and providing connectivity for devices in a home or small office environment. The firmware includes components like the DNS Resolution Handler, which processes domain name lookups to help devices reach websites.

What does OS command injection mean for CVE-2026-120345?

This vulnerability is categorized under CWE-77 and CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In plain terms, the router's DNS handler fails to properly filter input. An attacker can use this weakness to inject their own operating system commands, forcing the router to execute unauthorized instructions rather than just performing standard DNS tasks.

How is the command injection triggered in this router?

An attacker triggers this by sending specifically crafted, malformed data to the DNS Resolution Handler, specifically targeting the sub_41a430 function in the /bin/ioos file. The vulnerability is triggered during the processing of these arguments. Simply accessing the network or normal traffic that does not attempt to manipulate these DNS arguments will not trigger this specific flaw.

Is my device at risk based on Halo Surface Signal?

Yes, if you use this router model. Halo Surface Signal identifies the WAVLINK WN551X3-A as a consumer router acting as an internet gateway. Because these devices are designed to sit at the network edge to process traffic, they are inherently exposed to the public internet, making them primary targets for remote exploitation attempts that do not require internal network presence.

What should I do to secure my WAVLINK router?

Begin by creating an inventory of all instances of the WN551X3-A within your environment. Prioritize identifying which units are directly internet-facing, as these represent the highest risk. Determine who is responsible for managing these devices and ensure they are ready to apply updates or implement defensive measures once available from the manufacturer.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.