CVE-2026-120227 is a critical OS command injection flaw in the ioos Web Backend of WAVLINK WN701AE firmware M01AE_V260105, it can be exploited remotely, and a public exploit is available.
What Is It
The flaw is in the del_staticrule function of static_route_setting.sh, part of the ioos Web Backend on the WAVLINK WN701AE. An attacker who changes the rule_name argument can inject operating system commands. The record classifies the weakness as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
VulDB is the CNA. It published the CVE on 2026-11-01, and NVD lists it as "Received," which means NVD has not yet analyzed it.
Why It Matters
- CVSS 3.1: 9.9 CRITICAL (
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 8.6 HIGH, with exploit maturity rated Proof-of-Concept
- CVSS 2.0: 9.0 HIGH
The attack works over the network, has low complexity, and needs no user interaction. It does require low-level privileges, meaning some authenticated access. The CVSS 3.1 vector marks the scope as changed, with high impact to confidentiality, integrity and availability.
The CNA says the exploit "is now public and may be used," which leaves less time to fix exposed devices.
KEV status: No CISA KEV entry was supplied for this CVE. KEV does not currently confirm active exploitation in the wild.
What's Vulnerable
| Field | Value |
|---|---|
| Vendor | WAVLINK |
| Product | WN701AE |
| Component | ioos Web Backend |
| Affected version | M01AE_V260105 |
| CPE | cpe:2.3:o:wavlink:wn701ae_firmware:*:*:*:*:*:*:*:* |
The record does not say whether firmware versions other than M01AE_V260105 are affected.
Patch Status
The supplied data does not mention a fixed firmware version, a vendor advisory or a patch. The CNA says the vendor was contacted early about the disclosure but does not say how the vendor responded. No KEV entry was supplied, so there is no CISA required action or due date.
If you run WN701AE devices on M01AE_V260105, watch WAVLINK for a firmware update. The references below have the original disclosure details.