---
id: "CVE-2026-120227"
kind: "vulnerability"
aliases: ["CVE-2026-120227"]
title: "WAVLINK WN701AE router: web backend command injection via rule_name argument"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN701AE", "fixed": [], "affected": "M01AE_V260105", "ecosystem": "vendor"}]
ecosystems: []
tags: ["home-router", "infrastructure", "wavlink", "web-management", "wn701ae"]
not_affected_if: ["management-interface-not-exposed", "other-firmware-versions"]
published_at: "2026-11-01T13:18:00+00:00"
first_seen_at: "2026-11-01T13:20:07+00:00"
updated_at: "2026-11-01T13:22:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120227", "first_seen_at": "2026-11-01T13:20:07+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T13:22:53+00:00"}]
---

# WAVLINK WN701AE router: web backend command injection via rule_name argument

The WAVLINK WN701AE router firmware (M01AE_V260105) passes the rule_name argument of the del_staticrule function in static_route_setting.sh to an operating system command without sanitizing it. A remote attacker can inject shell commands and run them on the device, and a public exploit exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN701AE affected M01AE_V260105 fixed ?

## How to check

- Check the firmware version on the router's admin page (Status/System info); M01AE_V260105 is the version named in the report. Other versions are not stated either way.
- Check whether the web management interface is reachable from the internet (WAN/remote management setting); turn it off if so.
- Also check any other WAVLINK model you run: several WAVLINK models had separate command injection CVEs published at the same time.

## Timeline

- 2026-11-01T13:20:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120227
- 2026-11-01T13:22:53+00:00 analyst — Only VulDB (VDB-429586) found; it lists a public PoC (on github, link locked) and says no countermeasure is known; vendor contacted, no vendor advisory or fixed firmware found. Auth: CVSS4 vector has PR:L, which suggests authenticated, not vendor-confirmed. Nothing verified: no primary vendor page. Severity unchanged; no exploitation in the wild reported.

## Documents

- [describes] VulDB VDB-429586: WAVLINK WN701AE del_staticrule rule_name command injection https://vuldb.com/vuln/429586

## From the sources

A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_