Submit #907371: Wavlink WL-WN592AX6 M92AX6AI_V250422 Denial of Service

The CGI binary /cgi-bin/upload.cgi contains multiple pre-authentication DoS conditions reachable with zero authentication. (https://docs.wavlink.xyz/Firmware/?model=WL-WN592AX6)

Two independent pre-auth crash conditions, both confirmed via qemu-aarch64-static user-mode emulation with GDB remote debugging:
(1) No Cookie header sent: getenv("HTTP_COOKIE") returns NULL; strcpy(buf, NULL) immediately crashes with NULL pointer dereference at 0x401340.
(2) Cookie header sent without "token=" substring: strcpy succeeds; the subsequent strstr(buf, "token=") returns NULL; the code computes NULL+6 and dereferences that address via ldp at 0x40136c, causing a crash.

In both cases the CGI process crashes. No cookie, session token, or login of any kind is required to trigger either condition.

Additional observations beyond the crash itself:
main() calls fopen("/tmp/update_image", "w") unconditionally before reaching the vulnerable path, truncating the firmware image staging file on every invocation regardless of Cookie content. Any unauthenticated request can truncate this file during a concurrent legitimate firmware upload session. main() also unconditionally executes system("echo 3 > /proc/sys/vm/drop_caches") early in the execution path, flushing the OS page cache on every invocation. Repeated unauthenticated requests cause repeated system-wide page cache flushes, degrading overall device performance beyond the scope of the CGI process itself.

PoC:
Trigger A: curl -i -X POST -H "Content-Length: 0" http://<target>/cgi-bin/upload.cgi
Trigger B: curl -i -X POST -H "Content-Length: 0" -H "Cookie: foo=bar" http://<target>/cgi-bin/upload.cgi

• User: aissac (UID 100146)
• Submission: 07/28/2026 02:36 (3 months ago)
• Moderation: 10/12/2026 10:33 (3 months later)
• Status: Accepted
• VulDB entry: 416858 [Wavlink WL-WN592AX6 250422 /cgi-bin/upload.cgi main Cookie null pointer dereference]
• Points: 17