WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection
Affects WAVLINK WN701AE firmware M01AE_V260105 (ioos web backend). The checked facts list no vendor rating and no fix.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 22/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The ioos web backend of the WAVLINK WN701AE wireless router firmware is affected, specifically the static route deletion function. A remote attacker could exploit improper handling of the rule name input to inject operating system commands, potentially gaining control of the device.
Read the original description
A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
What to do
Check whether your setup matches what the bug needs.
Firmware version M01AE_V260105 of the WAVLINK WN701AE (ioos web backend)Workaround: The checked facts give no workaround and no fix. No mitigation is named in the available information.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- WAVLINK WN701AE
M01AE_V260105
Evidence 5
- Advisory
- Advisory
- Advisory
- Advisory
- Exploit
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120227
What does this mean?
The static route setting script's del_staticrule function passes input to an operating system command without proper checks. An attacker can run arbitrary commands with root privileges, which gives full control of the router.Source: github.com
Am I affected, and how do I check?
The listed affected firmware is version M01AE_V260105 of the WAVLINK WN701AE, using its ioos web backend. To check the firmware version on a device, compare it with M01AE_V260105.Source: github.com
What should I do about it?
The checked facts name no fixed version, so no upgrade target can be given. Watch for a vendor update that lists a fixed firmware version.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts give no workaround and no fix. No mitigation is named in the available information.Source: github.com