# CVE-2026-120230: WAVLINK WN701AE command injection in del_vlan_group

Source: https://junglewise.ai/threats/cve-2026-120230-a-vulnerability-was-found-in-wavlink-wn701ae-260105-impacted-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-120230 · Severity: critical · CVSS 9.9 · Published 2026-11-01

WAVLINK WN701AE is a router device that manages network configurations including VLANs through a web interface. An authenticated attacker can inject arbitrary commands through the del_vlan_group function to execute code with root privileges, potentially giving them complete control of the router including network traffic interception, firmware modification, and device compromises for botnet recruitment.

Vendors: [Wavlink](https://junglewise.ai/threats/vendors/wavlink).

## Quick answers

**Is CVE-2026-120230 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120230 being exploited in the wild.

**How severe is CVE-2026-120230?** Critical severity, with a CVSS score of 9.9, published 1 November 2026.

**Which products and versions are affected?** Wavlink WN701AE M01AE_V260105.

**Is there a fix for CVE-2026-120230?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120230 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-120230?** Check whether you run Wavlink WN701AE at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The del_vlan_group function in the ioos web backend fails to sanitize the vlan_name parameter before passing it to a system() call via snprintf. An authenticated attacker can inject shell metacharacters to execute arbitrary commands with root privileges. The vulnerability requires prior authentication to obtain a valid token, and exploitation is straightforward via a crafted HTTP GET request to /protocol.csp.

## Affected products

- WAVLINK WN701AE M01AE_V260105

## Timeline

- 2026-11-01: disclosed: Vulnerability published; exploit made public

## References

- [https://github.com/pipiyyb/cve/blob/main/WAVLINK_WN701AE_del_vlan_group.md](https://github.com/pipiyyb/cve/blob/main/WAVLINK_WN701AE_del_vlan_group.md)
- [https://vuldb.com/cve/CVE-2026-120230](https://vuldb.com/cve/CVE-2026-120230)

## Related threats

- [WAVLINK WN701AE OS command injection in static route setting](https://junglewise.ai/threats/cve-2026-120227-a-vulnerability-was-detected-in-wavlink-wn701ae-m01ae-v260105)