WAVLINK WN701AE CVE-2026-120230

Exploitation targets the del_vlan_group function of the WAVLINK WN701AE 'ioos' Web Backend: the attacker must be able to reach the device's web management interface over the network and supply a malicious vlan_name argument containing shell metacharacters, which is passed unsanitized into an OS command. The CVSS vector specifies PR:L, so a low-privilege authenticated session to the web backend is required - this is the primary limiting factor and means the flaw is not exploitable fully unauthenticated from available data. No user interaction is required (UI:N). Exploitation further depends on the management interface being network-reachable from the attacker's position (typically LAN, or WAN only if remote management is exposed), and is constrained to the specific WN701AE model at firmware 260105.

The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N) with high impact across VC/VI/VA and subsequent-system metrics yields an 8.6, indicating a network-reachable, low-complexity flaw that nonetheless requires some level of authentication (PR:L). This is an OS command injection (CWE-78) in the del_vlan_group handler of the device web backend, so successful exploitation means full command execution on the device. The vuln.today Decision label is 'this_week', consistent with a serious but not emergency-tier priority. There is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active, widespread exploitation; a public PoC reference exists (GitHub) but it is not verified as working exploit code. The reporting source is VulDB only, with no independent vendor advisory confirmed. Net: a genuinely high-severity flaw whose real-world risk is tempered by the PR:L authentication requirement and the niche, consumer-grade footprint of the affected product - treat as a near-term patching priority for exposed WAVLINK WN701AE devices rather than a mass-exploitation emergency. Note the PR:L requirement means this is not a fully unauthenticated takeover despite the network vector; verify against actual device auth defaults.

An attacker with low-privilege access to the WAVLINK WN701AE web management interface (e.g., a logged-in user, or an attacker who reaches the panel over the network) sends a crafted request to the del_vlan_group function with a malicious vlan_name value containing shell metacharacters. Because the parameter is passed unsanitized into an OS command, the injected commands execute on the device. A public PoC reference exists on GitHub, though it is not verified as working exploit code.