EUVD-2026-114839
GHSA-gx7m-hhf4-785q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach ioos web backend with low privilege
-
DeliverySubmit crafted rule_name to del_staticrule
-
ExploitShell interprets injected command
-
ExecutionExecute arbitrary OS commands on router
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the device's ioos web backend and at least low-level privilege (CVSS PR:L), after which the attacker manipulates the rule_name argument handled by the del_staticrule function in static_route_setting.sh to inject OS commands. The limiting factors are the need for that web-backend access/authentication level and the specific affected firmware (WN701AE M01AE_V260105); no user interaction is required (UI:N) and the attack works over the network against that web interface. The precise authentication boundary (which account tier satisfies PR:L) is not detailed in the available sources beyond the CVSS vector. |
| Impact | This is a CWE-78 OS command injection in the WAVLINK WN701AE (firmware M01AE_V260105) ioos web backend, reachable over the network. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scoring 8.6 indicates a low-complexity, network-reachable attack that nonetheless requires some privilege (PR:L) rather than being fully unauthenticated, and the input vector's exploit-maturity value is E:P (proof-of-concept). Aligning signals: a public PoC reference exists (GitHub) but is not verified as working exploit code, there is no CISA KEV listing and no EPSS probability was provided, and the vuln.today decision label is 'this_week' - not act_now/emergency. Taken together the signals describe a genuinely serious device-takeover flaw (command injection yields full OS impact) whose real-world exploitation is currently unproven: the authentication requirement (PR:L) and the niche consumer-router footprint temper the raw severity. Note the tension between the high VC/VI/VA/SC/SI/SA:H impact set in the input vector and the authenticated-access requirement - this reads as high impact once an attacker has web-backend access, not as mass-exploitable unauthenticated RCE. Missing data: no EPSS, no KEV, no vendor patch, so prioritize per the 'this_week' label rather than as an emergency. |
| Exploit ScenarioDerived | An attacker with access to the WN701AE web management interface (consistent with PR:L) submits a crafted rule_name value when deleting a static route; because del_staticrule in static_route_setting.sh passes this argument to a shell without sanitization, the injected command executes on the router OS. A public PoC reference exists but is not verified as working exploit code, so a functional weaponized exploit may still require development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Nov 01, 2026
OS command injection in the WAVLINK WN701AE (firmware M01AE_V260105) ioos web backend lets a network-positioned attacker who already holds a low-privileged account execute arbitrary OS commands on the device by manipulating the rule_name argument of the del_staticrule function in static_route_setting.sh. Successful exploitation compromises confidentiality, integrity and availability of the router itself and can extend to connected systems (assessed CVSS:3.1 8.6, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A public PoC reference exists in a GitHub write-up; it is not verified as working exploit code, and no CISA KEV listing indicates confirmed active exploitation. The vendor was contacted about the disclosure.
Earlier versions of this analysis (1)
OS command injection in the WAVLINK WN701AE (firmware M01AE_V260105) web management backend allows an attacker who holds a low-privileged session on the ioos Web Backend to execute arbitrary shell commands on the device by manipulating the rule_name argument passed to the del_staticrule function in static_route_setting.sh. Because the flaw sits in the static-route configuration feature and the CVSS 4.0 vector carries PR:L with AV:N, reachability of the management interface plus a low-privilege login are the binding preconditions rather than full administrative access. The vuln.today Decision label is act_now and the score is 9.4 Critical, but no CISA KEV entry exists and the only exploit reference is a public PoC write-up (GitHub pipiyyb/cve) that is not verified as working exploit code; no EPSS value was supplied with this record.
RemediationAI
No vendor-released patch or fixed firmware version is identified in the available sources; the only remediation path documented is the disclosure record, which notes the vendor was contacted early, so check the VulDB entries (https://vuldb.com/vuln/429586 and https://vuldb.com/cve/CVE-2026-120227) for a firmware update before deploying. Until a fixed build is confirmed, reduce exposure by removing the del_staticrule functionality from reach: restrict the ioos web backend so it is reachable only from a trusted management VLAN or specific administrative hosts via firewall rules, with the trade-off that management must then come from those hosts only; disable internet-side and WAN exposure of the web UI and remote-management features, which costs convenience for off-site administration. Because the vector requires a low-privileged authenticated session (PR:L), rotate and minimize device accounts and avoid sharing credentials with untrusted users, acknowledging that this lowers but does not eliminate risk since an attacker holding any qualifying account can still reach the vulnerable function. Do not rely on the public PoC write-up as proof of exploitability or as a test tool; it is an unverified reference, and testing on production devices should be avoided.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic CWE-78 OS command injection: the ioos web backend passes the user-supplied rule_name parameter into the shell function del_staticrule implemented in static_route_setting.sh without neutralizing shell metacharacters, so shell syntax embedded in the argument is interpreted by the underlying command interpreter. Because the vulnerable logic lives in a shell script invoked by the device's web management service, the injection context is the device's own command shell running with the web backend's (typically elevated) privileges. Per the CVSS vector, the attack is network-reachable and requires a low-privileged authenticated session (PR:L) with no user interaction (UI:N), which places the choke point at the ioos web interface rather than in any pre-authentication path; the sources do not specify which account tier satisfies that requirement. The affected scope is bounded to the WN701AE hardware running firmware M01AE_V260105, reflected by a CPE entry (cpe:2.3:a:wavlink:wn701ae:*:*:*:*:*:*:*:*) that carries no version constraint, so the precise set of other firmware builds that inherit the same static_route_setting.sh logic is not established by the available evidence. The trigger mechanism beyond the argument manipulation itself - for example whether the shell metacharacter must appear in a particular position or whether upstream sanitization exists in other call paths - is not described in the available sources.
Know when Wn701Ae gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable web backend (AV:N/AC:L), but the input vector's PR:L shows some authentication is needed; command injection grants full OS control, so C/I/A:H with no scope change (S:U).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Technical POC Analysis
CWE-78 (OS command injection) in the ioos web backend of WAVLINK WN701AE firmware M01AEV260105 (WAVLINK-WN701AE-WO-M01AEV260105-FM-BY.bin).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
CVE-2026-120227 is a high-severity OS command injection vulnerability in WAVLINK WN701AE routers (firmware M01AE_V260105) that allows a low-privileged authenticated attacker to execute arbitrary commands, compromising the router and potentially connected systems. Leadership should care because unpatched routers in the field pose a persistent risk of lateral movement and data exfiltration, especially if default or weak credentials grant initial access.
No vendor patch identified at time of analysis; interim mitigations include strict access controls, network segmentation, and monitoring for malicious activity.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB