CVE-2026-120230

Summary

A remote OS command injection flaw exists in the del_vlan_group function of the ioos Web Backend in WAVLINK WN701AE firmware v260105, where unsanitized user input for the vlan_name argument allows attackers to inject and execute arbitrary OS commands.

Exploitability

Exploitation requires low-privilege authenticated access (PR:L) with no user interaction needed (UI:N), and the exploit code is publicly available.

Blast radius

Successful exploitation grants high confidentiality, integrity, and availability impact (C:H/I:H/A:H) across the device, potentially enabling full system compromise, lateral movement, or persistent backdoor deployment.

Detection

Look for HTTP POST requests to the VLAN-related endpoint containing shell metacharacters (e.g., ;, |, $(), backticks) in the vlan_name parameter, followed by unexpected system process spawns or unusual outbound connections from the device.

Prioritized remediation

Upgrade to firmware version 260106 or later, as the vendor has released a patch; if unavailable, disable the VLAN management feature and restrict web backend access to trusted IPs.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.