{"id":"CVE-2026-120230","kind":"vulnerability","aliases":["CVE-2026-120230"],"related":[],"title":"WAVLINK WN701AE router: web backend flaw allows remote OS command injection","description":"A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","summary":"The WAVLINK WN701AE router's web backend passes the vlan_name argument of the del_vlan_group function into an operating system command without proper checks. A remote attacker can run commands on the device, and a public exploit has been released.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WN701AE","fixed":[],"affected":"260105 (M01AE_V260105)","ecosystem":"vendor"}],"ecosystems":[],"tags":["home-router","infrastructure","iot","wavlink","wn701ae"],"not_affected_if":["admin-interface-not-reachable","no-wn701ae-device"],"how_to_check":"- Log in to the router admin page and read the firmware version; WN701AE on 260105 (M01AE_V260105) is the reported affected build. No fixed build is named in any source.\n- Check whether the web management interface is reachable from the internet or from untrusted networks (WAN, guest Wi-Fi). The CVSS vector lists low privileges required, so an authenticated session is likely needed, but no source confirms this.\n- Also check any other WAVLINK models running the ioos web backend; sibling bugs are reported in the WN553X1-B.","fix":null,"status":"open","published_at":"2026-11-01T15:17:22+00:00","first_seen_at":"2026-11-01T15:20:34+00:00","triaged_at":"2026-11-01T15:22:22+00:00","updated_at":"2026-11-01T15:23:13+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-01T15:22:22Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WAVLINK WN701AE router: web backend flaw allows remote OS command injection","impact":"high","summary":"The WAVLINK WN701AE router's web backend passes the vlan_name argument of the del_vlan_group function into an operating system command without proper checks. A remote attacker can run commands on the device, and a public exploit has been released.","audience":"everyone","category":"infrastructure","nicknames":[],"who_cares":["wavlink","wn701ae","home-router","iot"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs operating system commands on the router","analyst_note":"Confirm whether authentication is required for the del_vlan_group endpoint and whether a vendor firmware fix exists; the NVD entry is the only source given.","how_to_check":"- Identify whether any WAVLINK WN701AE devices are on your network, including firmware version `260105`\n- Check whether the router's web management interface is reachable from the internet\n- unknown for other checks, as the sources do not say","plain_action":"If you own a WAVLINK WN701AE router, check the manufacturer's site for a firmware update and install it; until then, avoid exposing its admin page to the internet.","needs_analyst":true,"not_affected_if":["no-wn701ae-device","admin-interface-not-reachable"],"who_is_affected":"Devices running WAVLINK WN701AE firmware version 260105, where the web management backend is reachable. The sources do not describe the exact configuration required beyond the remote attack path, so the web interface being reachable from an attacker's network is the main exposure factor. Systems not running this device are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000722,"input_tokens":4122,"output_tokens":619,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether authentication is required for the del_vlan_group endpoint and whether a vendor firmware fix exists; the NVD entry is the only source given.","search":"'-120230':14A,17A '-2026':13A,16A '260105':75C 'allow':7A 'argument':37B,93C 'attack':54B,102C 'backend':5A,32B,88C 'check':51B 'command':10A,48B,57B,99C 'compon':85C 'contact':121C 'could':115C 'cve':12A,15A 'del':40B,80C 'devic':60B 'disclosur':125C 'earli':122C 'exploit':64B,109C 'flaw':6A 'found':71C 'function':43B,79C 'group':42B,82C 'home':20B 'home-rout':19B 'impact':76C 'infrastructur':22B 'inject':11A,100C 'ioo':86C 'iot':23B 'made':112C 'manipul':90C 'may':103C 'name':36B,95C 'oper':46B 'os':9A,98C 'pass':33B 'perform':105C 'proper':50B 'public':63B,113C 'releas':67B 'remot':8A,53B,107C 'result':96C 'router':3A,21B,29B 'run':56B 'system':47B 'use':117C 'vendor':119C 'vlan':35B,41B,81C,94C 'vulner':69C 'wavlink':1A,24B,27B,73C 'web':4A,31B,87C 'without':49B 'wn701ae':2A,18A,25B,28B,74C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a WAVLINK WN701AE on firmware 260105 whose web management page can be reached by an attacker. The CVE record says the attack is remote and a public exploit exists; the CVSS vector suggests low-privilege login is required, but no source confirms it. Those without this model, or with the admin page limited to a trusted LAN, can mostly skip it. No vendor fix is known yet.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"If you own a WAVLINK WN701AE router, turn off remote access to its admin page and check the WAVLINK website for a firmware update.","first_public_at":"2026-11-01T15:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120230","severity":null,"published_at":"2026-11-01T15:17:22+00:00","modified_at":"2026-11-01T15:17:22+00:00","first_seen_at":"2026-11-01T15:20:34+00:00","fetched_at":"2026-11-01T15:20:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120230:1306","url":null,"severity":null,"published_at":"2026-11-01T15:23:13+00:00","modified_at":"2026-11-01T15:23:13+00:00","first_seen_at":"2026-11-01T15:23:13+00:00","fetched_at":"2026-11-01T15:23:13+00:00","note":"Only NVD/CVE record (VulDB CNA) and aggregators found; no WAVLINK advisory or firmware fix located, so nothing verified. CVSS vector has PR:L (some login likely needed) but no source states auth requirement for del_vlan_group; PoC public per CNA, no exploitation reported (not in KEV). Sibling WAVLINK ioos CVEs exist (120227, 120228, 120229)."}],"documents":[{"id":39476,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120230","title":"NVD CVE-2026-120230","kind":"advisory","source":"analyst","publisher":null,"text":"A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. Manipulation of argument vlan_name results in os command injection. Remote attack possible. Exploit public. Vendor contacted early. CNA VulDB CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":39477,"url":"https://radar.offseq.com/threat/cve-2026-120230-os-command-injection-in-wavlink-wn701ae-9fe8b83735b800c8","title":"OffSeq Threat Radar CVE-2026-120230","kind":"other","source":"analyst","publisher":null,"text":"CVSS 4.0 9.4. Exploit maturity: POC public. Not in CISA KEV, no reported exploitation. No fixed version listed.","published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}