CVE-2026-120230: Command Injection

Published Nov 1, 2026

Updated

A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function delvlangroup of the component ioos Web Backend. The manipulation of the argument vlanname results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.

Event History

Nov 1, 2026

CVE Published

via NVD·03:17 PM

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attack can be performed remotely and requires low privileges. No user interaction is required.

Is public exploit information available?

Yes. The exploit has been made public and could be used.

Which component and input are involved?

The affected function is del_vlan_group in the ioos Web Backend. The command injection is triggered through manipulation of the vlan_name argument.

Which firmware version is identified as affected?

The reported affected product and version is WAVLINK WN701AE 260105.

CVE-2026-120230: Command Injection

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Is public exploit information available?

Which component and input are involved?

Which firmware version is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Is public exploit information available?

Which component and input are involved?

Which firmware version is identified as affected?