WAVLINK WN551X3-A, CVE-2026-120344: a new CVE scored 10

The bottom line

Check whether you run WAVLINK WN551X3-A. If you do, read the vendor's page for the fixed version and update. Nothing public says yet that anyone is using this flaw.

Free analysis report · 8 pagesWAVLINK WN551X3-A, CVE-2026-120344: a new CVE scored 10The same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →

At a glance

Does this apply to you?

What it is

An attacker who can reach the router over the network can inject operating-system commands through the WireGuard CLI Group Handler by manipulating the group_name argument, which can give full control of the device.

Why it matters

The record gives this a CVSS 4.0 score of 10, the maximum possible. The weaknesses are CWE-78 and CWE-77, both forms of command injection, which allow an attacker to run arbitrary operating-system commands as the process owner. The record states the exploit has been disclosed to the public. Our reading is that a maximum-severity, remotely exploitable, publicly disclosed command injection flaw in a network device warrants immediate action even without a CISA listing.

Exposure by situation

These priorities are our judgement from what the sources say about who can use the flaw and how. They are not vendor ratings.

Things people will get wrong

• It is not on CISA's exploited list, so we can wait. The record scores it 10 out of 10 and states the exploit is public. CISA's list records confirmed exploitation; absence from it does not mean the exploit is not in use.
• Only sites actively using WireGuard VPN are at risk. The record names the WireGuard CLI Group Handler as the attack path but does not confirm WireGuard must be active; the firmware version alone is the affected condition named in the record.

How we would triage it

This is our judgement.

Step 1: Find the firmware version on the device

• Log in to the WAVLINK WN551X3-A administration interface and locate the firmware version on the system or status page.
• The affected version the record names is M51X3_V251020-WO-182e965; confirm whether the device matches before taking further action.

Step 2: Restrict access to the management interface

• If the device is internet-facing or reachable by untrusted parties, block external access to the administration and WireGuard interfaces immediately.
• The record states the attack may be performed remotely; reducing who can reach the device reduces exposure while a patch is sought.

Step 3: Check for a firmware update

• No fixed version is named in the public record and no vendor page could be read; check the WAVLINK support site directly for a firmware update for the WN551X3-A.
• Do not apply a firmware version that the vendor has not confirmed addresses this flaw.

Step 4: Review recent device logs for unexpected activity

• Check the device's system logs for unexpected commands, new accounts, or configuration changes made while the device was reachable from untrusted networks.
• The attack leads to OS command injection; look for processes or commands that would not be expected in normal router operation.

To close it, read the version from the product itself, not from an old inventory, and save the output with the date. If you cannot update today, write down who owns it, the new date, and what limits exposure until then.

The weakness behind it

The record classes this as CWE-78 and CWE-77.

• CWE-78 →What this kind of mistake is, and which exploited vulnerabilities share it.
• CWE-77 →What this kind of mistake is, and which exploited vulnerabilities share it.

The sources, in their words

The CVE record:

A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

Versions of WAVLINK WN551X3-A the record lists as affected:

• M51X3_V251020-WO-182e965

Check your own project

If you build software, you can compare what a project declares with this CVE from a terminal. The tool reads requirements files, package.json, Maven, Gradle, Cargo, CMake and Dockerfile files, runs nothing, and only the CVE id leaves your machine. Naming the CVEs needs no key.

lattice-scan project . --cve CVE-2026-120344

Each row says in-range, outside-range, undetermined or lead, with the file and line. That is evidence about what a manifest declares, not about what runs, and a person decides. The verdicts, the CSV columns and a pipeline recipe are in the guide.

Guide: namiq.io/lattice/guides/choose-your-channel. MCP server (io.namiq/lattice in the MCP registry): namiq.io/lattice. Package: pypi.org/project/lattice-scan, or namiq.io/apt.

• Which way into Lattice fits your job →The command line, the Claude skill or the MCP server: what each needs, what works without a key and how to read the result.
• Lattice, the MCP server →The public graph the command reads, for AI agents over MCP.
• Install and connect →The signed apt repository, the fingerprint, and the connection commands for each client.

What we do not know yet

• No fixed firmware version is named in any source; it is not known whether the vendor has issued or plans to issue a patch for this flaw.
• The record does not state whether the attack requires the WireGuard feature to be enabled, or merely that the firmware contains the vulnerable code.
• It is not stated whether authentication is required before the vulnerable function in the WireGuard CLI Group Handler can be reached.
• No vendor advisory or workaround has been published; the analysis rests on the VulDB record alone.
• Exploitation is not recorded. That is not the same as none.
• This is a new record: scores, versions and wording can change in the first days, and they are as at 2 November 2026. We have not read the vendor's advisory page and we have not tested it.
• The sections headed "Does this apply to you?", "What it is", "Why it matters", "Exposure by situation", "Things people will get wrong" and "How we would triage it" are our interpretation of the sources, not a statement by CISA or the vendor.

• The day's CVE highlight →The three new records we picked that day, and how we chose them.
• Today's mission →Every exploited vulnerability from the last seven days, in the order their deadlines fall.