CVE-2026-120227: Command Injection

Published Nov 1, 2026

Updated

A vulnerability was detected in WAVLINK WN701AE M01AEV260105. This affects the function delstaticrule of the file staticroutesetting.sh of the component ioos Web Backend. Performing a manipulation of the argument rulename results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.

Event History

Nov 1, 2026

CVE Published

via NVD·01:18 PM

Data Sourced

via NVD·01:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

Exploitation is remote over the network and does not require user interaction, but the attacker must have low-level privileges. The attack complexity is rated low.

Why should this be prioritized?

The vulnerability is rated high severity with high impact to confidentiality, integrity, and availability. A public exploit is available, increasing the likelihood of exploitation.

Is a remediation release identified?

The available information identifies WAVLINK WN701AE firmware M01AE_V260105 as affected, but does not provide a fixed version or workaround.

CVE-2026-120227: Command Injection

Event History

Frequently Asked Questions

What level of access does an attacker need?

Why should this be prioritized?

Is a remediation release identified?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

Why should this be prioritized?

Is a remediation release identified?