| Title | Wavlink WL-WN592AX6 M92AX6AI_V250422 OS Command Injection |
|---|
| Description | Wavlink WL-WN592AX6 firmware M92AX6AI_V250422 is affected by an unauthenticated remote code execution vulnerability in the wmapd daemon. An attacker on the same Layer 2 network segment can achieve OS command injection (CWE-78) without authentication by sending a crafted L2 packet to inject a command into a heap buffer via strncpy, followed by a TCP packet to port 12838 that triggers execution of the injected command through sprintf and system(). This vulnerability was discovered through static analysis only using Ghidra. See a link on advisory/exploit below for technical details and PoC script.
Note for coordination: Already reported to MITRE (tracking number CAN-2026-2034753) over a week ago. No substantive response received despite a follow-up inquiry. Please coordinate with MITRE as needed to avoid a duplicate CVE assignment. |
|---|
| Source | ⚠️ https://drive.google.com/file/d/1KtZZ7kjVswRgP2VLEx7M7gEafyY8Wp2Q/view?usp=drive_link |
|---|
| User | aissac (UID 100146) |
|---|
| Submission | 08/03/2026 01:44 (3 months ago) |
|---|
| Moderation | 10/12/2026 10:33 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416861 [Wavlink WL-WN592AX6 250422 wmapd Daemon system os command injection] |
|---|
| Points | 20 |
|---|