Live › vulnerability › CVE-2026-120227
The WAVLINK WN701AE router firmware (M01AE_V260105) passes the rule_name argument of the del_staticrule function in static_route_setting.sh to an operating system command without sanitizing it. A remote attacker can inject shell commands and run them on the device, and a public exploit exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 13:20 UTC. All times on this page are UTC.
Owners of the WAVLINK WN701AE router on firmware M01AE_V260105, where the ioos web backend handles static route deletion (del_staticrule). Exposure is greatest when the web management interface is reachable from outside the local network. The CVSS vector from VulDB lists low privileges required, so a login is probably needed, but no source states this outright. Other firmware versions are not stated as affected or safe.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN701AE | vendor | M01AE_V260105 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120227")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.