On this page (7 sections)
A high-severity OS command injection flaw, tracked as CVE-2026-120230, has been reported in the WAVLINK WN701AE, version 260105. The weakness sits in the device's web backend, and the public record says an exploit has been made public.
If you manage offices, client sites, or hosting-adjacent networks that use WAVLINK networking gear, this is worth a quick inventory check. The record lists no patched version, so the practical focus is limiting who can reach the device's management interface.
What happened
The GitHub Advisory Database entry describes a flaw in the WAVLINK WN701AE 260105. The function del_vlan_group in the ioos Web Backend component mishandles the argument vlan_name, which leads to OS command injection. The entry says the attack may be performed remotely and that the vendor was contacted early about the disclosure.
The NVD record carries the same text, so it is the same single report rather than separate confirmation. A write-up linked from the advisory sits in a public repository, and the entry is also tracked by VulDB. The sources we reviewed contain no vendor advisory, no firmware fix and no reports of attacks against real targets.
Technical details
OS command injection happens when a device builds a system command from user-supplied input without safely handling it. If an attacker controls part of that input, the device may run commands the author never intended. Here the affected input is the vlan_name argument handled by del_vlan_group in the device's web backend.
The CVSS v4 metrics in the advisory describe a network attack vector, low attack complexity, no attack requirements, low privileges required and no user interaction. Impact is rated high for confidentiality, integrity and availability, on both the vulnerable system and subsequent systems. In plain terms, according to those metrics, an attacker who can reach the interface and has a low-privilege account could potentially run commands on the device. The advisory does not say how such an account would be obtained.
Who is affected
Anyone running a WAVLINK WN701AE on version 260105 should consider themselves in scope. Realistic exposure depends on where the management interface is reachable. This is general guidance, not something the advisory states:
- Highest risk: the web interface is reachable from the internet, or from a guest or shared network.
- Moderate risk: the interface is only on an internal network, but staff devices, IoT gear or other untrusted hosts share it.
- Lower risk: management is restricted to a dedicated admin network with strong, unique credentials.
A compromised network device can expose traffic or act as a foothold for reaching internal systems. For site owners, that matters most when the device sits between your office, staging environment or admin tools and the internet.
How to check your exposure
Start with an inventory. Find any WAVLINK WN701AE units in your offices, client sites and data closets, and note the firmware version shown in the admin interface. Then check who can reach that interface.
From a machine outside your network, you can test whether the device's admin port answers. Replace the placeholder with your public IP address. This is a read-only request using the standard curl tool, and a timeout or refused connection is the result you want:
curl -I --max-time 10 http://YOUR_PUBLIC_IP/If it returns a login page or any HTTP response, the management interface is exposed. Also review the device's admin account list and logs for logins or configuration changes you do not recognize. For your websites, a read-only scan of sites you own shows what is visible from outside, and the free SSL checker covers certificate issues, though neither tests this router flaw.
What to do now
Because no patched version is listed, assume you must reduce exposure yourself until WAVLINK publishes a fix. Check the vendor's support pages for firmware updates and apply one if it names this issue.
0 of 8 done
Detection and monitoring
Command injection on a router rarely shows up on your websites directly, so watch the network layer. Alert on new administrative logins, unexpected configuration or VLAN changes, and outbound connections from the device to unfamiliar hosts. If you can forward router logs to a central place, keep them for review.
Also watch what your public addresses expose over time. Webforta Monitor can track certificate, DNS and header changes on your sites, which helps you notice unexpected changes after a network incident. If you suspect a compromise, see our guide on what to do if a site is hacked.
Timeline
| Date | Event |
|---|---|
| Before Nov 1, 2026 | Vendor contacted early about the disclosure, per the advisory text (exact date not given) |
| Nov 1, 2026 | CVE-2026-120230 published by the National Vulnerability Database and added to the GitHub Advisory Database |
| Nov 1, 2026 | No patched version or vendor advisory listed in the sources we reviewed |
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.