WAVLINK WN701AE ioos Web Backend static_route_setting.sh del_staticrule os command injection (WAVLINK WN701AE)
At a glance
- Source
- NVD
- State
- PUBLISHED
- Published
- Updated
- Assigner
- VulDB
- NVD status
- Received
Description
A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation of the argument rule_name results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure.
Weaknesses (CWE)
- CWE-78 — Improper Neutralization of Special Elements used in an OS Command
- CWE-77 — Improper Neutralization of Special Elements used in a Command
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | CRITICAL 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P | VulDB |
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| CVSS 3.0 | CRITICAL 9.9 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:X/RC:R | VulDB |
| CVSS 2.0 | CRITICAL 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR | VulDB |
| CVSS 4.0 | HIGH 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · cna@vuldb.com (Secondary) |
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · cna@vuldb.com (Primary) |
| CVSS 2.0 | HIGH 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C | NVD · cna@vuldb.com (Secondary) |
European references
- ENISA EUVD · EUVD-2026-114839
- GCVE · GCVE-0-2026-120227
Affected products
| Product | Versions |
|---|---|
| WAVLINK · WN701AE | affected M01AE_V260105 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |