CVE-2026-120227 WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection
CriticalCVSS 9.4
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wavlink wn701ae firmware | = M01AE_V260105 | No fix listed |
References
- VDB-429586 | WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection technical-description vdb-entry
- VDB-429586 | CTI Indicators (IOB, IOC, TTP, IOA) permissions-required signature
- CVE-2026-120227 | CVE Analysis and Report third-party-advisory
- Submit #918620 | WAVLINK WL-WN701AE M01AE_V260105 CWE-78 third-party-advisory
- github.com exploit