CVE-2026-109107

MediumCVSS 6.5

Published: 13/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Summary

Wavlink WL-WN592AX6 version 250422 is vulnerable to a null pointer dereference in the main function of /cgi-bin/upload.cgi, triggered by manipulation of the Cookie argument. The attack can be performed remotely.

Risk Assessment

A remote attack can cause device crashes or unexpected behavior, potentially leading to service disruption or further attacks.

Recommendation

Contact the vendor for a patch or consider restricting access to the device from external networks.

Other vulnerabilities in Wavlink WL-WN592AX6

CVE-2026-109110Critical
The Wavlink WL-WN592AX6 router version 250422 contains a vulnerability in the system function of the wmapd daemon component. Manipulation of an argument leads to OS command injection, and the attack can be launched remotely.

Original NVD description (English source)

A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS