A critical vulnerability in a second WAVLINK router model, published on 2 November 2026, allows operating-system command injection and is rated 10.0 out of 10, the maximum severity score. The flaw, CVE-2026-120345, affects the WAVLINK WN551X3-A device running firmware M51X3_V251020-WO-182e965, according to the CVE record tracked by OffSeq Threat Radar. It is distinct from the WN536AX6-A flaw covered by DailyByte on 2 November, which involved a different model and different handler.

How the flaw works

The vulnerability sits in the device's DNS Resolution Handler component, specifically the sub_41a430 function in the file /bin/ioos. Manipulating that handler can lead to operating-system command injection, meaning an attacker can trick the device into running commands on its operating system. The CVE record lists a public exploit as available, and it does not list a fixed firmware version.

What owners should do

Until a vendor fix is available, owners of the named model should check the vendor's site for a security update, restrict remote access to the router's management interfaces, and consider isolating the device from untrusted networks. The same model family has seen several critical command-injection records published on 2 November, so owners should check for the whole model, not just one flaw, and should not assume that updating one WAVLINK device fixes another.

What is not claimed here

This article does not claim the flaw is in CISA's Known Exploited Vulnerabilities catalogue, and it does not claim confirmed exploitation in the wild beyond the CVE record's statement that an exploit is publicly available. Readers should treat the exploit-availability statement as the tracker's record, while the underlying flaw itself, remote command injection in the named firmware, is recorded in the CVE entry.

Sources: OffSeq Threat Radar, CVE-2026-120345, 2 November 2026; CVE database record via OffSeq.