{"id":"CVE-2026-120227","kind":"vulnerability","aliases":["CVE-2026-120227"],"related":[],"title":"WAVLINK WN701AE router: web backend command injection via rule_name argument","description":"A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","summary":"The WAVLINK WN701AE router firmware (M01AE_V260105) passes the rule_name argument of the del_staticrule function in static_route_setting.sh to an operating system command without sanitizing it. A remote attacker can inject shell commands and run them on the device, and a public exploit exists.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN701AE","fixed":[],"affected":"M01AE_V260105","ecosystem":"vendor"}],"ecosystems":[],"tags":["home-router","infrastructure","wavlink","web-management","wn701ae"],"not_affected_if":["management-interface-not-exposed","other-firmware-versions"],"how_to_check":"- Check the firmware version on the router's admin page (Status/System info); M01AE_V260105 is the version named in the report. Other versions are not stated either way.\n- Check whether the web management interface is reachable from the internet (WAN/remote management setting); turn it off if so.\n- Also check any other WAVLINK model you run: several WAVLINK models had separate command injection CVEs published at the same time.","fix":null,"status":"open","published_at":"2026-11-01T13:18:00+00:00","first_seen_at":"2026-11-01T13:20:07+00:00","triaged_at":"2026-11-01T13:21:52+00:00","updated_at":"2026-11-01T13:22:53+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-01T13:21:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN701AE router: web backend command injection via rule_name argument","impact":"high","summary":"The WAVLINK WN701AE router firmware (M01AE_V260105) passes the rule_name argument of the del_staticrule function in static_route_setting.sh to an operating system command without sanitizing it. A remote attacker can inject shell commands and run them on the device, and a public exploit exists.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn701ae","home-router","web-management"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the router as a remote user","analyst_note":"Confirm the fixed firmware version and whether authentication is required to reach del_staticrule; check the vendor advisory from the NVD entry.","how_to_check":"- Check the firmware version on the router's admin page against `M01AE_V260105`\n- Confirm whether the router's web management interface is reachable from the internet\n- unknown","plain_action":"If you own a WAVLINK WN701AE router, check its firmware version and watch for a vendor update; the sources do not say a fix is available yet.","needs_analyst":true,"not_affected_if":["other-firmware-versions","management-interface-not-exposed"],"who_is_affected":"Owners of the WAVLINK WN701AE router on firmware M01AE_V260105, where the ioos web backend handles static route deletion. Exposure is greatest when the web management interface is reachable from outside the home or office network. The sources do not say whether other firmware versions or models are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000723,"input_tokens":4148,"output_tokens":616,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed firmware version and whether authentication is required to reach del_staticrule; check the vendor advisory from the NVD entry.","search":"'-120227':14A,17A '-2026':13A,16A 'affect':83C 'argument':11A,39B,103C 'attack':57B,115C 'backend':5A,97C 'command':6A,51B,61B,109C 'compon':94C 'contact':130C 'cve':12A,15A 'del':42B,86C 'detect':76C 'devic':67B 'disclosur':134C 'earli':131C 'exist':72B 'exploit':71B,112C,119C 'file':90C 'firmwar':32B 'function':44B,85C 'home':20B 'home-rout':19B 'infrastructur':22B 'inject':7A,59B,110C 'ioo':95C 'm01ae':33B,80C 'manag':26B 'manipul':100C 'may':124C 'name':10A,38B,105C 'oper':49B 'os':108C 'pass':35B 'perform':98C 'possibl':117C 'public':70B,122C 'remot':56B,111C 'result':106C 'router':3A,21B,31B 'rule':9A,37B,104C 'run':63B 'sanit':53B 'shell':60B 'static_route_setting.sh':46B,91C 'staticrul':43B,87C 'system':50B 'use':126C 'v260105':34B,81C 'vendor':128C 'via':8A 'vulner':74C 'wavlink':1A,23B,29B,78C 'web':4A,25B,96C 'web-manag':24B 'without':52B 'wn701ae':2A,18A,27B,30B,79C","nicknames":[],"mitigations":[],"who_affected":"Owners of the WAVLINK WN701AE router on firmware M01AE_V260105, where the ioos web backend handles static route deletion (del_staticrule). Exposure is greatest when the web management interface is reachable from outside the local network. The CVSS vector from VulDB lists low privileges required, so a login is probably needed, but no source states this outright. Other firmware versions are not stated as affected or safe.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you own a WAVLINK WN701AE router, check its firmware version and watch for a vendor update; the sources do not say a fix is available yet.","first_public_at":"2026-11-01T13:18:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120227","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120227","severity":null,"published_at":"2026-11-01T13:18:00+00:00","modified_at":"2026-11-01T13:18:00+00:00","first_seen_at":"2026-11-01T13:20:07+00:00","fetched_at":"2026-11-01T13:20:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120227:1298","url":null,"severity":null,"published_at":"2026-11-01T13:22:53+00:00","modified_at":"2026-11-01T13:22:53+00:00","first_seen_at":"2026-11-01T13:22:53+00:00","fetched_at":"2026-11-01T13:22:53+00:00","note":"Only VulDB (VDB-429586) found; it lists a public PoC (on github, link locked) and says no countermeasure is known; vendor contacted, no vendor advisory or fixed firmware found. Auth: CVSS4 vector has PR:L, which suggests authenticated, not vendor-confirmed. Nothing verified: no primary vendor page. Severity unchanged; no exploitation in the wild reported."}],"documents":[{"id":38997,"url":"https://vuldb.com/vuln/429586","title":"VulDB VDB-429586: WAVLINK WN701AE del_staticrule rule_name command injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}