Description
A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Published: 2026-11-01
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: OS Command Injection
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the del_vlan_group function of the ioos Web Backend on WAVLINK WN701AE firmware 260105. A crafted string supplied in the vlan_name argument allows an attacker to inject and execute arbitrary operating‑system commands, compromising the device’s confidentiality and integrity and potentially disrupting connected networks. The flaw can be exploited from remote hosts and public exploits have already been published, underscoring its operational impact.

Affected Systems

WAVLINK WN701AE wireless router, firmware version 260105. The vulnerable component is the web backend that processes VLAN deletion requests.

Risk and Exploitability

The CVSS score of 9.4 classifies the flaw as critical. With no EPSS data but an available public exploit that can be launched over the Internet, the likelihood of exploitation is high. The vulnerability is not yet listed in CISA’s KEV catalog, but the remote attack vector and lack of a released fix greatly increase the risk of real‑world compromise.

Generated by OpenCVE AI on November 1, 2026 at 15:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the device firmware to the latest release that addresses the del_vlan_group command injection flaw.
  • Restrict access to the Web UI by configuring firewalls or ACLs to permit management traffic only from trusted IP ranges or through a VPN.
  • If a firmware upgrade is not immediately available, disable the VLAN deletion capability in the router’s configuration or remove the affected endpoint from the web backend.
  • Consider isolating the device in a separate network segment protected by a secure firewall to limit exposure.
  • Monitor traffic for anomalous command execution or unexpected patterns that may indicate exploitation attempts.

Generated by OpenCVE AI on November 1, 2026 at 15:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 01 Nov 2026 14:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Title WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection
First Time appeared Wavlink
Wavlink wn701ae Firmware
Weaknesses CWE-77
CWE-78
CPEs cpe:2.3:o:wavlink:wn701ae_firmware:*:*:*:*:*:*:*:*
Vendors & Products Wavlink
Wavlink wn701ae Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Wavlink Wn701ae Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-01T14:15:16.021Z

Reserved: 2026-10-31T19:35:27.111Z

Link: CVE-2026-120230

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-01T15:17:22.830

Modified: 2026-11-01T15:17:22.830

Link: CVE-2026-120230

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-01T15:30:07Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')