WAVLINK WN701AE: OS command injection in ioos web backend
Summary
A vulnerability in the ioos web backend of WAVLINK WN701AE firmware 260105 allows OS command injection via the vlan_name parameter of the del_vlan_group function. According to the CVE data, the attack can be performed remotely and a public exploit exists. The research notes describe the exploit as requiring authentication with a low privilege level, and a successful attack could lead to root-level command execution on the device.
Affected
- WAVLINK WN701AE firmware 260105 (M01AE_V260105 as listed by the advisory)
- Component: ioos Web Backend, function del_vlan_group, parameter vlan_name
Fixed in
Unknown. No vendor advisory or fixed firmware version has been identified.
Workaround
- Do not expose the web management interface to the internet; restrict it to a management VLAN or trusted admin hosts.
- Change default or weak administrator credentials and review who can access the web interface.
- Segment the device from sensitive and guest or IoT networks.
- Monitor the device for unexpected configuration changes or outbound connections.
- No vendor-recommended workaround is known.
Exploitation
- Public exploit: VulDB states the exploit has been made public and could be used.
- In-the-wild exploitation: no evidence found.
- Authentication is required to obtain a valid token before exploitation.
Our recommendation
- Inventory all WAVLINK WN701AE devices and their firmware versions.
- Confirm whether the web interface is reachable from the internet or from guest or IoT networks, and close that exposure.
- Check the vendor website for newer firmware and contact WAVLINK support if none is available.
- If an internet-facing or unpatched device cannot be secured, isolate or replace it.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB CVE-2026-120230 vuldb.com
- VulDB entry 429589 vuldb.com
- Public advisory (GitHub, pipiyyb/cve) github.com
- WAVLINK firmware update FAQ www.wavlink.com
- OffSeq radar CVE-2026-120230 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:21.
Original description (NVD)
A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.