CVE-2026-120230 is a critical (CVSS 3.1: 9.9) OS command injection flaw in the ioos Web Backend of WAVLINK WN701AE firmware version 260105. An exploit is public and the attack can be carried out remotely.
What Is It
The flaw is in the del_vlan_group function of the WN701AE's ioos Web Backend component. Manipulating the vlan_name argument leads to OS command injection. The CNA (VulDB) classifies the weakness as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. An attacker can exploit it over the network with low complexity and no user interaction. They need low-level privileges. The scope is changed, and the impact on confidentiality, integrity and availability is high.
Why It Matters
- Remote exploitation: The NVD description says the attack can be launched remotely.
- Public exploit: The CNA says the exploit "has been made public and could be used." The CVSS 4.0 metric puts Exploit Maturity at Proof-of-Concept.
- High scores across versions: CVSS 3.1 9.9 (Critical), CVSS 4.0 8.6 (High) and CVSS 2.0 9.0 (High). The CVSS 4.0 vector rates impact on the vulnerable system and on subsequent systems as high.
- KEV status: The supplied CISA KEV entry is empty. KEV does not currently confirm active exploitation of this CVE.
Low-privileged access to the web backend may be enough to run OS commands on the device. Because the scope is changed, the impact can reach beyond the vulnerable component.
What's Vulnerable
| Field | Value |
|---|---|
| Vendor | WAVLINK |
| Product | WN701AE |
| Component | ioos Web Backend |
| Function | del_vlan_group |
| Parameter | vlan_name |
| Affected version | 260105 |
| CPE | cpe:2.3:o:wavlink:wn701ae_firmware:*:*:*:*:*:*:*:* |
The NVD record lists firmware version 260105 as affected. The CPE entry uses a wildcard for the version.
Patch Status
The supplied data contains no vendor patch, fixed firmware version or advisory. The CNA says WAVLINK was contacted early about the disclosure. The record doesn't say whether the vendor responded. Because there is no KEV entry, there is no CISA required action or due date.
The NVD record was published on 2026-11-01 and has the status "Received," so it has not yet been analyzed by NVD. Owners of WN701AE devices on firmware 260105 should check WAVLINK for updated firmware and watch for changes to the record.