CVE-2026-109110 in WL-WN592AX6
Summary
by MITRE • 10/13/2026
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The Wavlink WL-WN592AX6 router, specifically firmware version 250422, contains a critical security vulnerability within its wmapd daemon component that allows for remote operating system command injection. This flaw resides in the core system management functions of the device, which are responsible for handling administrative tasks and configuration updates. The presence of this vulnerability indicates a significant failure in input validation and sanitization processes within the network access point manager daemon. Attackers can exploit this weakness by sending specially crafted requests to the affected service over the network. Because the wmapd component typically operates with elevated privileges, successfully executing these malicious inputs grants the attacker the ability to run arbitrary commands on the underlying operating system of the router.
This vulnerability is classified under CWE-78, which describes Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The technical nature of this flaw suggests that user-supplied data from network requests is being passed directly to shell interpreters or system command execution functions without adequate filtering. This allows malicious actors to inject additional commands into the intended operation, effectively bypassing any intended security controls within the application layer. The impact extends beyond simple service disruption; it results in a complete compromise of device integrity. An attacker can read sensitive configuration files, modify network settings, install persistent backdoors, or use the compromised router as a pivot point to attack other devices on the local network.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Command and Scripting Interpretation, specifically T1059. The ability to execute commands remotely makes this a high-severity issue that is particularly dangerous in Internet of Things (IoT) environments where devices often have limited security monitoring capabilities. The fact that an exploit has been published significantly increases the risk landscape, as it lowers the barrier to entry for less sophisticated attackers who can leverage existing proof-of-concept code rather than developing their own exploits from scratch. This accelerates the potential wave of automated attacks targeting vulnerable instances across the internet.
The vendor was contacted early regarding this disclosure, indicating that the issue has been identified through responsible vulnerability research practices. However, until a patched firmware version is released and deployed by end-users, devices running the affected 250422 firmware remain exposed to remote exploitation. Mitigation strategies should prioritize updating the router firmware as soon as an official patch becomes available from Wavlink. In the interim, network administrators can implement temporary controls such as restricting access to the management interface via firewall rules or disabling unnecessary services if possible. It is also advisable to change default credentials and monitor logs for unusual outbound connections that might indicate successful exploitation of this command injection flaw.