{"id":"CVE-2026-120230","published":"2026-11-01T15:17:22.830","lastModified":"2026-11-01T15:17:22.830","description":"A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK_WN701AE_del_vlan_group.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-120230","tags":[]},{"url":"https://vuldb.com/submit/919242","tags":[]},{"url":"https://vuldb.com/vuln/429589","tags":[]},{"url":"https://vuldb.com/vuln/429589/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/pipiyyb/cve/blob/main/WAVLINK_WN701AE_del_vlan_group.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A remote OS command injection flaw exists in the del_vlan_group function of the ioos Web Backend in WAVLINK WN701AE firmware v260105, where unsanitized user input for the vlan_name argument allows attackers to inject and execute arbitrary OS commands.","exploitability":"Exploitation requires low-privilege authenticated access (PR:L) with no user interaction needed (UI:N), and the exploit code is publicly available.","blast_radius":"Successful exploitation grants high confidentiality, integrity, and availability impact (C:H/I:H/A:H) across the device, potentially enabling full system compromise, lateral movement, or persistent backdoor deployment.","remediation":"Upgrade to firmware version 260106 or later, as the vendor has released a patch; if unavailable, disable the VLAN management feature and restrict web backend access to trusted IPs.","detection":"Look for HTTP POST requests to the VLAN-related endpoint containing shell metacharacters (e.g., ;, |, $(), backticks) in the vlan_name parameter, followed by unexpected system process spawns or unusual outbound connections from the device.","tags":["os-command-injection","web-interface","embedded-device","authenticated","rce"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:49:17.251Z"}}