CVE-2026-120344 explained: what to do about the WAVLINK WN551X3-A M51X3_V251020-WO-182e965 flaw

The two-minute check

1. Find the physical label on the device and look for the model number WN551X3-A.
2. Log into the device's admin panel and open its system or status page.
3. Look for a firmware version string and compare it to M51X3_V251020-WO-182e965.
4. Note whether you use any WireGuard-related command-line or remote-management feature on the device.

What the record does and does not tell us

The official record for this flaw lists no vendor or product name in its structured fields (NVD). Its written description names WAVLINK WN551X3-A M51X3_V251020-WO-182e965 directly, along with a specific file and function inside it. The record doesn't say whether other firmware builds or hardware revisions are also affected. Check your own device's firmware version against the one above, and don't assume a different build number is safe just because it isn't named.

What the official record says

This flaw carries a Common Vulnerability Scoring System (CVSS) score of 10 out of 10, rated CRITICAL (NVD). The scoring vector shows the attack can be launched over the network, with low attack complexity, no privileges required, and no user interaction needed (NVD). In plain terms, an attacker who can reach the device over the network can run commands on it. Nobody needs to click anything or enter a password first.

The flaw sits inside a file called /bin/ioos, in a WireGuard command-line group handling feature. An input field named group_name isn't checked properly before being passed to the system (VulDB). That gap lets an attacker insert their own operating system commands, a technique known as command injection. Exploit code for this has already been shared publicly, and the vendor was notified ahead of that disclosure (GitHub advisory). The record shows no confirmed exploitation in the wild yet, and this flaw is not currently on the Known Exploited Vulnerabilities (KEV) catalog.

What that means for a business like yours

A CVSS 10 means confidentiality, integrity and availability are all rated as fully compromised in a successful attack (NVD). Practically, someone who reaches this device over your network, or over the internet if it's exposed, could take it over completely. That could mean redirecting your traffic, reading data passing through it, or using it as a foothold into the rest of your network. Working exploit code already being public makes this worth acting on, even without confirmed attacks yet.

If someone else manages your IT

Send this to your IT provider:

"Please check whether we have a WAVLINK WN551X3-A device anywhere on our network. If we do, check whether it runs firmware M51X3_V251020-WO-182e965. This firmware has a critical remote command injection flaw, CVE-2026-120344. Please isolate it from the internet and let me know what you find."

If you don't currently have a provider doing this kind of check, a managed IT services team can take this on as part of ongoing monitoring.

If you manage it yourself

1. Log into the device's admin panel using its usual web address.
2. Find the WAN-facing or remote-management setting and turn it off.
3. Restrict admin panel access to your local network only, not the internet.
4. Disable the WireGuard command-line feature if you don't need it right now.
5. Write down the firmware version and today's date so you can compare it after a future update.

The record shows no confirmed exploitation yet, and this flaw is not on the KEV catalog (NVD). That can change quickly once exploit code is public, which it already is (GitHub advisory). Given the CVSS 10 score and the public exploit, treat this as something to check within the next few business days. If this device later appears on the KEV catalog, treat that as a signal to prioritize it immediately.

Confirming a full fix isn't possible yet, because the record lists no patched firmware version. What you can confirm is that your exposure is reduced. Log back into the admin panel and verify remote management is still turned off. Try reaching the admin panel from outside your network; the connection should fail. Check your firewall or router logs for inbound connection attempts aimed at the device's management port.

• Turning off remote or WAN management stops outside attackers from reaching the device directly. It does not stop someone already inside your local network.
• A firewall rule blocking inbound traffic to the device's management port narrows who can reach it. A misconfigured rule can still leave it open, so verify it works.
• Putting the device on its own network, separate from computers and servers, limits what an attacker can reach if it's compromised. It does not protect the device itself.
• Reviewing device logs won't prevent an attack, but it can tell you sooner if something unusual is happening.

Restricting who can reach administrative interfaces like this one is also a core part of privileged access management, worth applying across your network generally, not just this device. For a broader view of where this fits into your overall exposure, our cybersecurity services team can help assess it.

Do I have to do anything if we only use this at home?

This guide is written for a business network, but the same flaw affects any WAVLINK WN551X3-A M51X3_V251020-WO-182e965 device wherever it's installed. If you use one at home, the same checks and the same remote-management setting apply.

Will turning off remote management break anything?

Turning off remote management only affects access to the device from outside your local network. Day-to-day traffic passing through the device should keep working normally.

Is there a patch we should install?

Not yet. The official record doesn't list a fixed firmware version, so there's nothing to install right now. Check the vendor's advisory for the current version before assuming one exists (VulDB).

How do we know if we've already been attacked through this?

The record shows no confirmed exploitation yet, so there's no known attack pattern to search for specifically. Unusual outbound traffic from the device, unexpected admin accounts, or unfamiliar devices on your network are worth investigating.

Should we just replace the device?

That's a reasonable option if the device is exposed to the internet and you don't need the WireGuard command-line feature. A managed IT provider can help you weigh replacement against isolation while you wait for a fix.

If you want a second set of eyes on this device, and everything else sitting on your network, start with a free IT assessment or contact LayerLogix directly. We bring 20+ years of experience and 100% U.S.-based support to exactly this kind of exposure check.