CVE-2026-109110

CriticalCVSS 10.0

Published: 13/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Summary

The Wavlink WL-WN592AX6 router version 250422 contains a vulnerability in the system function of the wmapd daemon component. Manipulation of an argument leads to OS command injection, and the attack can be launched remotely.

Risk Assessment

Remote execution of arbitrary system commands on the device is possible, potentially leading to full router compromise. The exploit has been publicly disclosed and may be used.

Recommendation

Apply the vendor patch when available, and until then restrict access to the router management interface from untrusted networks.

Other vulnerabilities in Wavlink WL-WN592AX6

CVE-2026-109107Medium
Wavlink WL-WN592AX6 version 250422 is vulnerable to a null pointer dereference in the main function of /cgi-bin/upload.cgi, triggered by manipulation of the Cookie argument. The attack can be performed remotely.

Original NVD description (English source)

A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS