Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-120230

OS Command Injection in WAVLINK WN701AE ioos Web Backend

CVSS 4.0
8.6 high
EPSS
—
Published
·
Modified
Analyze CVE-2026-120230 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

OS command injection in del_vlan_group function of WAVLINK WN701AE ioos Web Backend via vlan_name manipulation. Remote unprivileged attack possible over network. Attacker executes arbitrary commands. Public exploit available. Affected: WAVLINK WN701AE 260105.

What to do: Upgrade WAVLINK WN701AE to latest version. No workaround provided.

ProductAffected
WAVLINK WN701AE260105
Estimated exposure
nicheNo basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

Weakness
CWE-77, CWE-78
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD CVE.org GitHub PoCs EPSS (—)

In the news

0 stories

No ingested article mentions this CVE yet.