CVE-2026-120230 WAVLINK CVE debrief

Who should care

Defenders responsible for WAVLINK WN701AE 260105 devices should assess exposure and prioritize verification of the vulnerability in their inventory. This includes reviewing system logs for signs of exploitation and considering compensating controls or monitoring for potential exploitation. The vulnerability's high severity and public exploit availability make it crucial for defenders to take immediate action to assess and mitigate the risk.

Why it matters

CVE-2026-120230 is a high-severity vulnerability in WAVLINK WN701AE 260105 devices that allows remote OS command injection. Defenders should prioritize verification and assessment of exposure due to public exploit availability.

• Remote exploitation of the vulnerability could lead to OS command injection
• Public exploit availability increases the risk of exploitation
• Verification of the vulnerability in inventory is necessary to assess exposure

Technical summary

The vulnerability is caused by improper neutralization of special elements used in an OS command in the del_vlan_group function of the ioos Web Backend. This allows remote attackers to inject OS commands via the vlan_name argument. The vulnerability has a high CVSS score of 8.6, indicating a high severity. The exploit has been made public, and defenders should prioritize verification and assessment of exposure due to public exploit availability and potential for remote exploitation. The vulnerability affects WAVLINK WN701AE 260105 devices.

Defensive priority

Defenders should prioritize verifying the vulnerability in their inventory and assessing exposure, as the exploit is public and could be used.

Recommended defensive actions

• Verify the vulnerability in your inventory
• Assess exposure to the vulnerability
• Consider compensating controls or monitoring for potential exploitation
• Review vendor guidance for patching or mitigation
• Conduct a thorough review of system logs for signs of exploitation
• Prioritize patching or mitigation based on risk assessment
• Monitor for indicators of compromise related to this vulnerability

Evidence notes

The CVE record and NVD vulnerability detail page provide information about the vulnerability, including its CVSS score and weaknesses (CWE-77 and CWE-78). The vulnerability is caused by improper neutralization of special elements used in an OS command in the del_vlan_group function of the ioos Web Backend. This allows remote attackers to inject OS commands via the vlan_name argument. The exploit has been made public, increasing the risk of exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.