WAVLINK WN701AE: OS command injection in web backend via rule_name
Summary
The web backend (ioos) of the WAVLINK WN701AE router, firmware M01AE_V260105, does not sanitize the rule_name parameter in the static route deletion function (del_staticrule). An authenticated attacker can inject shell commands that run with root privileges, which can lead to full compromise of the router. Public proof-of-concept code exists, and no fixed firmware version is known.
Affected
- WAVLINK WN701AE, firmware M01AE_V260105 (only version listed as affected)
Fixed in
Unknown. No fixed firmware version has been published.
Workaround
- No vendor mitigation documented.
- Disable remote management and remove any internet exposure of the web administration interface.
- Restrict admin access to a trusted management VLAN or specific IP addresses.
Exploitation
- Public proof-of-concept available (VulDB status: Proof-of-Concept).
- No evidence of active exploitation in the wild found.
- Attacker needs a valid login to the web interface (low privileges), no user interaction required.
Our recommendation
- Identify all WN701AE devices and their firmware versions.
- Remove internet exposure of their management interfaces immediately.
- Replace devices running M01AE_V260105 where possible, or isolate them until a vendor fix is confirmed.
- Change the admin password to a strong, unique one and monitor for unexpected static-route changes.
- Re-check the vendor and NVD pages regularly, as the status may change quickly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-120227 vuldb.com
- VulDB entry 429586 vuldb.com
- GitHub write-up (pipiyyb/cve) github.com
- OffSeq Radar CVE-2026-120227 radar.offseq.com
- Wavlink firmware issues www.wavlink.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:22.
Original description (NVD)
A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.