WAVLINK WN701AE M01AEV240305 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.

A vulnerability was detected in WAVLINK WN701AE M01AEV260105. This affects the function delstaticrule of the file staticroutesetting.sh of the component ioos Web Backend. Performing a manipulation of the argument rulename results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.