CVE-2026-120227

Summary

A command injection flaw in the ioos Web Backend of WAVLINK WN701AE firmware allows authenticated attackers to execute arbitrary OS commands via manipulation of the rule_name argument in the del_staticrule function of static_route_setting.sh.

Exploitability

Exploitation requires valid low-privilege credentials and network access; public exploits exist, making exploitation trivial for attackers.

Blast radius

Successful exploitation grants full system compromise (confidentiality, integrity, availability) due to OS command execution with the service account’s privileges.

Detection

Look for HTTP POST requests to /static_route_setting.sh containing suspicious shell metacharacters (e.g., ;, |, $(), backticks) in the rule_name parameter, especially followed by common OS commands like wget, curl, or sh; also monitor for unexpected outbound connections to external IPs or execution of non-standard processes in system logs.

Prioritized remediation

Upgrade to firmware version M01AE_V260106 or later, as the vendor has likely patched this issue; if unavailable, disable the static route management feature or restrict access to the affected endpoint to trusted IPs only.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.