Wavlink WL-WN592AX6 CVE-2026-109107

Exploitation requires network reachability to the Wavlink WL-WN592AX6 web management interface (firmware build 250422) and the ability to send an HTTP request to the /cgi-bin/upload.cgi endpoint with an attacker-controlled Cookie header; no authentication or user interaction is needed per CVSS PR:N/UI:N. The primary limiting factor is exposure: these range extenders are typically on LANs and not internet-facing by default, so realistic risk depends heavily on whether the management interface is reachable from the attacker's position. Impact is confined to denial of service of the CGI handler; there is no code execution, privilege gain, or data disclosure.

This is a genuinely low-to-moderate priority issue despite the 6.9 CVSS 4.0 score. The vector (AV:N/AC:L/PR:N/UI:N) describes a remote, unauthenticated, low-complexity attack, which raises the score, but the actual impact is a null pointer dereference (CWE-476) in the upload.cgi handler - a denial-of-service condition only. The CVSS impact metrics reflect this limited blast radius: VC:N (no confidentiality loss), VI:L and VA:L (only partial integrity/availability effect), and no scope change, so there is no code execution or data disclosure. The SSVC/exploit-maturity signal is E:P (proof-of-concept), consistent with the description's statement that public exploit code exists; this is NOT confirmed active exploitation. There is no CISA KEV listing and no EPSS value supplied in the input, so widespread automated exploitation cannot be asserted. Signals are broadly consistent (network DoS, POC available, no RCE), so the main driver of real risk is simply whether the affected Wavlink device is internet-exposed. Note the VI:L marking is slightly unusual for a pure null-pointer DoS, which usually maps to availability only - verify with the vendor/VulDB whether any integrity effect truly applies.

A remote attacker who can reach the device's web management interface sends a crafted HTTP request to /cgi-bin/upload.cgi with a malicious Cookie header value, triggering a null pointer dereference in the main function and crashing the CGI handler. Public proof-of-concept exploit code is reported to exist, lowering the effort required. The result is a denial of service (process/service crash) rather than code execution or data theft.