Live › vulnerability › CVE-2026-120230
The WAVLINK WN701AE router's web backend passes the vlan_name argument of the del_vlan_group function into an operating system command without proper checks. A remote attacker can run commands on the device, and a public exploit has been released.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 15:20 UTC. All times on this page are UTC.
Anyone running a WAVLINK WN701AE on firmware 260105 whose web management page can be reached by an attacker. The CVE record says the attack is remote and a public exploit exists; the CVSS vector suggests low-privilege login is required, but no source confirms it. Those without this model, or with the admin page limited to a trusted LAN, can mostly skip it. No vendor fix is known yet.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WN701AE | vendor | 260105 (M01AE_V260105) | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-120230")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.