---
id: "CVE-2026-120230"
kind: "vulnerability"
aliases: ["CVE-2026-120230"]
title: "WAVLINK WN701AE router: web backend flaw allows remote OS command injection"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "WN701AE", "fixed": [], "affected": "260105 (M01AE_V260105)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["home-router", "infrastructure", "iot", "wavlink", "wn701ae"]
not_affected_if: ["admin-interface-not-reachable", "no-wn701ae-device"]
published_at: "2026-11-01T15:17:22+00:00"
first_seen_at: "2026-11-01T15:20:34+00:00"
updated_at: "2026-11-01T15:23:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120230", "first_seen_at": "2026-11-01T15:20:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T15:23:13+00:00"}]
---

# WAVLINK WN701AE router: web backend flaw allows remote OS command injection

The WAVLINK WN701AE router's web backend passes the vlan_name argument of the del_vlan_group function into an operating system command without proper checks. A remote attacker can run commands on the device, and a public exploit has been released.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:WN701AE affected 260105 (M01AE_V260105) fixed ?

## How to check

- Log in to the router admin page and read the firmware version; WN701AE on 260105 (M01AE_V260105) is the reported affected build. No fixed build is named in any source.
- Check whether the web management interface is reachable from the internet or from untrusted networks (WAN, guest Wi-Fi). The CVSS vector lists low privileges required, so an authenticated session is likely needed, but no source confirms this.
- Also check any other WAVLINK models running the ioos web backend; sibling bugs are reported in the WN553X1-B.

## Timeline

- 2026-11-01T15:20:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120230
- 2026-11-01T15:23:13+00:00 analyst — Only NVD/CVE record (VulDB CNA) and aggregators found; no WAVLINK advisory or firmware fix located, so nothing verified. CVSS vector has PR:L (some login likely needed) but no source states auth requirement for del_vlan_group; PoC public per CNA, no exploitation reported (not in KEV). Sibling WAVLINK ioos CVEs exist (120227, 120228, 120229).

## Documents

- [advisory] NVD CVE-2026-120230 https://nvd.nist.gov/vuln/detail/CVE-2026-120230
- [mentions] OffSeq Threat Radar CVE-2026-120230 https://radar.offseq.com/threat/cve-2026-120230-os-command-injection-in-wavlink-wn701ae-9fe8b83735b800c8

## From the sources

A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_