{"id":"CVE-2026-120227","published":"2026-11-01T13:18:00.643","lastModified":"2026-11-01T13:18:00.643","description":"A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN701AE.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120227","tags":[]},{"url":"https://vuldb.com/submit/918620","tags":[]},{"url":"https://vuldb.com/vuln/429586","tags":[]},{"url":"https://vuldb.com/vuln/429586/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK%20WN701AE.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection flaw in the ioos Web Backend of WAVLINK WN701AE firmware allows authenticated attackers to execute arbitrary OS commands via manipulation of the rule_name argument in the del_staticrule function of static_route_setting.sh.","exploitability":"Exploitation requires valid low-privilege credentials and network access; public exploits exist, making exploitation trivial for attackers.","blast_radius":"Successful exploitation grants full system compromise (confidentiality, integrity, availability) due to OS command execution with the service account’s privileges.","remediation":"Upgrade to firmware version M01AE_V260106 or later, as the vendor has likely patched this issue; if unavailable, disable the static route management feature or restrict access to the affected endpoint to trusted IPs only.","detection":"Look for HTTP POST requests to /static_route_setting.sh containing suspicious shell metacharacters (e.g., ;, |, $(), backticks) in the rule_name parameter, especially followed by common OS commands like wget, curl, or sh; also monitor for unexpected outbound connections to external IPs or execution of non-standard processes in system logs.","tags":["rce","command-injection","webapp","firmware","authenticated"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:47:53.721Z"}}