CVE-2026-120230

CriticalCVSS 9.9

Published: 01/11/2026(UTC)Translated: 01/11/2026(UTC)NVD NIST

Summary

A vulnerability was found in WAVLINK WN701AE 260105 in the function del_vlan_group of the ioos Web Backend. Manipulating the vlan_name argument results in OS command injection. The attack may be performed remotely and the exploit has been made public.

Risk Assessment

A remote attacker could execute arbitrary commands on the device, potentially taking control of the router and network. The public exploit increases the risk of exploitation.

Recommendation

Update the device firmware to the vendor-patched version or restrict access to the web interface. Until a fix is available, isolate the device on the network.

Other vulnerabilities in WAVLINK WN701AE

CVE-2026-120227Critical
A vulnerability was detected in WAVLINK WN701AE M01AE_V260105 affecting the del_staticrule function in static_route_setting.sh of the ioos Web Backend component. Manipulation of the rule_name argument leads to OS command injection. Remote exploitation is possible, and the exploit is publicly available and may be used.

Original NVD description (English source)

A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS