WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection
Affects only WAVLINK WN701AE firmware M01AE_V260105, through the ioos web backend del_vlan_group function. CVSS rates it critical (9.4). No fix is listed in the checked facts.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 22/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The WAVLINK WN701AE router's ioos web backend is affected, specifically its VLAN group deletion function. Attackers on the network could exploit improper handling of the vlan_name input to run arbitrary operating system commands on the device.
Read the original description
A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
What to do
Check whether your setup matches what the bug needs.
Affects WAVLINK WN701AE firmware M01AE_V260105 (the ioos web backend del_vlan_group function)Workaround: The checked facts do not list a fixed firmware version or a workaround. Until the vendor publishes a fix, the only documented detail is the affected function, del_vlan_group in the ioos web backend.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- WAVLINK WN701AE
260105
Evidence 5
- Advisory
- Advisory
- Advisory
- Advisory
- Exploit
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120230
What does this mean?
The del_vlan_group function in the ioos web backend passes input into an operating system command without proper handling, which is an OS command injection flaw. An attacker can run arbitrary commands with root privileges on the device and gain full control of the router.Source: github.com
Am I affected, and how do I check?
Firmware version M01AE_V260105 of the WAVLINK WN701AE is the version named as affected. To check a device, compare its firmware version with M01AE_V260105.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What if there's no patch?
The checked facts do not list a fixed firmware version or a workaround. Until the vendor publishes a fix, the only documented detail is the affected function, del_vlan_group in the ioos web backend.Source: github.com