CVE-2026-120230: WAVLINK WN701AE Command Injection
An OS command injection vulnerability was published on November 1, 2026 affecting the WAVLINK WN701AE (firmware 260105). Tracked as CVE-2026-120230 with a CVSS score of 9.9, the flaw is in the del_vlan_group function of the ioos web backend. The exploit has been made public.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-120230 |
| CVSS Score | 9.9 (Critical) |
| CWE Classification | CWE-78 — OS Command Injection |
| Affected Software | WAVLINK WN701AE, version 260105 |
| Vulnerable Component | del_vlan_group in the ioos web backend |
| Vulnerable Parameter | vlan_name |
| Attack Vector | Network (remote) |
| Published | November 1, 2026 |
| Exploitation | Public exploit disclosed; not in CISA KEV |
Technical Description
Manipulating the vlan_name argument passed to del_vlan_group results in OS command injection: the value reaches a shell command without sanitization. An attacker with access to the device's web interface can run commands as the web backend's user, which on consumer and SOHO routers is commonly root.
This is part of a cluster of WAVLINK /bin/ioos command injection disclosures, and the same product line has had similar flaws before.
Impact Assessment
| Impact Area | Description |
|---|---|
| Confidentiality | Device configuration, Wi-Fi and VPN credentials exposed |
| Integrity | Firmware settings and DNS can be altered; persistence possible |
| Availability | Device can be disrupted or bricked |
| Lateral Movement | A compromised router is a foothold into the local network and a candidate botnet node |
Remediation Guidance
- No vendor patch was identified at publication. Check WAVLINK's support site for updated firmware.
- Do not expose the management interface to the internet; restrict it to a trusted management VLAN.
- Replace or isolate affected devices if they must remain reachable.
- Audit for unexpected configuration changes, DNS settings, or outbound connections from the device.
Key Takeaways
- WN701AE firmware 260105 has a CVSS 9.9 command injection with a public exploit
- No patch was available at publication, so reduce exposure now
- Keep router management interfaces off the internet