| Title | Wavlink WL-WN592AX6 M92AX6AI_V250422 Denial of Service |
|---|
| Description | The CGI binary /cgi-bin/upload.cgi contains multiple pre-authentication DoS conditions reachable with zero authentication. (https://docs.wavlink.xyz/Firmware/?model=WL-WN592AX6)
Two independent pre-auth crash conditions, both confirmed via qemu-aarch64-static user-mode emulation with GDB remote debugging:
(1) No Cookie header sent: getenv("HTTP_COOKIE") returns NULL; strcpy(buf, NULL) immediately crashes with NULL pointer dereference at 0x401340.
(2) Cookie header sent without "token=" substring: strcpy succeeds; the subsequent strstr(buf, "token=") returns NULL; the code computes NULL+6 and dereferences that address via ldp at 0x40136c, causing a crash.
In both cases the CGI process crashes. No cookie, session token, or login of any kind is required to trigger either condition.
Additional observations beyond the crash itself:
main() calls fopen("/tmp/update_image", "w") unconditionally before reaching the vulnerable path, truncating the firmware image staging file on every invocation regardless of Cookie content. Any unauthenticated request can truncate this file during a concurrent legitimate firmware upload session. main() also unconditionally executes system("echo 3 > /proc/sys/vm/drop_caches") early in the execution path, flushing the OS page cache on every invocation. Repeated unauthenticated requests cause repeated system-wide page cache flushes, degrading overall device performance beyond the scope of the CGI process itself.
PoC:
Trigger A: curl -i -X POST -H "Content-Length: 0" http://<target>/cgi-bin/upload.cgi
Trigger B: curl -i -X POST -H "Content-Length: 0" -H "Cookie: foo=bar" http://<target>/cgi-bin/upload.cgi |
|---|
| User | aissac (UID 100146) |
|---|
| Submission | 07/28/2026 02:36 (3 months ago) |
|---|
| Moderation | 10/12/2026 10:33 (3 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416858 [Wavlink WL-WN592AX6 250422 /cgi-bin/upload.cgi main Cookie null pointer dereference] |
|---|
| Points | 17 |
|---|