9.9
CriticalCVSS 3.1 · from VulDB
CVE-2026-120230
WAVLINK WN701AE ioos Web Backend del_vlan_group os command injection
WN701AE · OS command injection · CWE-78AffectedWN701AE
FixNo fix listed yet.
PublishedNov 1, 14:15 · VulDB
ScoredNov 1 · 9.9 · VulDB
Exploit code publicNone known · checked 23:18 UTC
ExploitedNone known · CISA KEV checked 23:19 UTC
What we know
No known exploitation. CISA KEV, checked 23:19 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 23:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
Description
A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.
From VulDB
Affected and fixed versions
ProductAffectedFixed inWN701AE260105–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known