Wn701Ae
Monthly
OS command injection in the del_vlan_group function of the WAVLINK WN701AE (firmware 260105) ioos web backend allows network-reachable attackers to execute arbitrary shell commands on the device. The CVSS 4.0 vector (PR:L, AC:L, UI:N) shows a low-complexity attack that requires a low-privilege authenticated session on the web management interface, with high confidentiality, integrity and availability impact across the vulnerable and subsequent systems; an EPSS-style exploitability metric of E:P and a public PoC reference (not verified as working exploit code) exist. No CISA KEV entry confirms active exploitation, but the flaw is considered high priority this week because of its severity and the presence of public technical detail.
OS command injection in the WAVLINK WN701AE (firmware M01AE_V260105) ioos web backend lets a network-positioned attacker who already holds a low-privileged account execute arbitrary OS commands on the device by manipulating the rule_name argument of the del_staticrule function in static_route_setting.sh. Successful exploitation compromises confidentiality, integrity and availability of the router itself and can extend to connected systems (assessed CVSS:3.1 8.6, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A public PoC reference exists in a GitHub write-up; it is not verified as working exploit code, and no CISA KEV listing indicates confirmed active exploitation. The vendor was contacted about the disclosure.
OS command injection in the del_vlan_group function of the WAVLINK WN701AE (firmware 260105) ioos web backend allows network-reachable attackers to execute arbitrary shell commands on the device. The CVSS 4.0 vector (PR:L, AC:L, UI:N) shows a low-complexity attack that requires a low-privilege authenticated session on the web management interface, with high confidentiality, integrity and availability impact across the vulnerable and subsequent systems; an EPSS-style exploitability metric of E:P and a public PoC reference (not verified as working exploit code) exist. No CISA KEV entry confirms active exploitation, but the flaw is considered high priority this week because of its severity and the presence of public technical detail.
OS command injection in the WAVLINK WN701AE (firmware M01AE_V260105) ioos web backend lets a network-positioned attacker who already holds a low-privileged account execute arbitrary OS commands on the device by manipulating the rule_name argument of the del_staticrule function in static_route_setting.sh. Successful exploitation compromises confidentiality, integrity and availability of the router itself and can extend to connected systems (assessed CVSS:3.1 8.6, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). A public PoC reference exists in a GitHub write-up; it is not verified as working exploit code, and no CISA KEV listing indicates confirmed active exploitation. The vendor was contacted about the disclosure.