CVE-2026-120230: critical vulnerability in WAVLINK WN701AE
WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.4epss 2.2%
A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Affected products
WAVLINK · WN701AEpublic PoCs found — 1
cve_referencegithub.com/pipiyyb/cve/blob/main/WAVLINK_WN701AE_del_vlan_group.mdunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — WAVLINK WN701AE
In the same product, most dangerous first.