EUVD-2026-98325
GHSA-6fjw-pj9v-fhcm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device management/network interface
-
DeliverySend crafted request to wmapd 'system' function
-
ExploitInject shell metacharacters (command injection)
-
ExecutionExecute arbitrary OS commands on device
-
ImpactFull device compromise / pivot into network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the WL-WN592AX6's management surface served by the wmapd daemon; a request reaching the vulnerable 'system' function with attacker-controlled input containing shell metacharacters is sufficient. Per the CVSS vector (PR:N/UI:N), no authentication and no user interaction are required, implying exploitation against default configurations. The principal limiting factor is exposure scope: the device is a consumer range extender whose management interface is typically LAN-facing, so remote Internet exploitation depends on the interface being WAN-exposed or the attacker being on the local/adjacent network. |
| Impact | This is a genuinely high-priority flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with full H impact to vulnerable and subsequent systems) describes a network-reachable, low-complexity, unauthenticated OS command injection (CWE-78) in the wmapd daemon of the Wavlink WL-WN592AX6 - the easiest-to-exploit profile there is. The input confirms a publicly available exploit (echoed by the 4.0 Exploit Maturity metric E:P, Proof-of-Concept), which materially raises near-term risk. Countervailing signals: no EPSS score is provided and the device is NOT on the CISA KEV list, so there is no evidence of active, widespread exploitation yet - the signal is 'proven exploitable with public code' rather than 'confirmed exploited in the wild.' The disclosure is sourced solely to VulDB with no independent vendor advisory (vendor was contacted but no fix is referenced), so affected-version and patch data are single-source. Net: treat as a real, actionable priority for anyone running this specific device, but note the risk is bounded by the product's limited deployment footprint rather than its severity. |
| Exploit ScenarioDerived | An attacker with network reachability to the device's management interface sends a crafted request to the vulnerable 'system' function in the wmapd daemon, injecting shell metacharacters that are passed unsanitized to an OS command. Because exploitation requires no authentication, no user interaction, and low complexity, the attacker gains arbitrary command execution on the device. A public proof-of-concept exploit has been published (hosted via VulDB/Google Drive), lowering the barrier to weaponization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 13, 2026
OS command injection in Wavlink WL-WN592AX6 firmware 250422 allows unauthenticated network attackers to execute arbitrary shell commands through the wmapd daemon's system function when they can reach the device management surface. The flaw is tracked as CVE-2026-109110 (CWE-78) with a 9.3 CVSS v4.0 score, and publicly available exploit code exists, though no confirmed active exploitation is indicated in the supplied data. Exploitation requires network access to the affected management interface; because this consumer range extender is typically LAN-facing, Internet exposure depends on WAN exposure or an attacker on the local/adjacent network.
Earlier versions of this analysis (1)
Unauthenticated OS command injection in the Wavlink WL-WN592AX6 (firmware build 250422) wmapd daemon allows remote attackers to execute arbitrary shell commands on the device, with the supplied CVSS 4.0 vector scoring 10.0 and an independent CVSS 3.1 assessment of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8). Multiple signals align toward genuine high risk, but with one important caveat: the practical reachability of the wmapd daemon determines whether exploitation is LAN-limited or fully internet-facing; no authentication or user interaction is required, and publicly available exploit code exists. No CISA KEV entry was provided, so active exploitation is not confirmed.
RemediationAI
No vendor-released patch version is identified in the supplied references, so no exact fixed firmware can be cited; consult Wavlink support and the linked VulDB advisory for an updated firmware release, and treat the public exploit reference as a reason to prioritize mitigation. Because the CVSS vector shows PR:N and UI:N, authentication changes are not a sufficient control; the primary practical mitigation is to remove exposure of the wmapd management surface. Do not forward management ports from the WAN, disable remote administration features, place the device on an isolated VLAN or guest network with no access to trusted hosts, and apply firewall rules that restrict management access to trusted administrative IPs only. These controls limit remote exploitation attempts but trade off convenience for remote administration and may not fully protect against an attacker already on the same LAN. Monitor the device and network for unexpected outbound connections or shell-like command activity, and update immediately when Wavlink publishes a fixed firmware version.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the wmapd daemon on Wavlink WL-WN592AX6 firmware version 250422, a consumer Wi-Fi range extender. The vulnerability is an OS command injection flaw (CWE-78: Improper Neutralization of Special Elements used in an OS Command), where the vulnerable 'system' function fails to sanitize attacker-controlled input containing shell metacharacters before passing it to an operating-system command. This allows injected commands to run with the privileges of the wmapd daemon. The CVSS v4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P indicates network-exploitable, low-complexity attack with no authentication or user interaction, and the independent assessment aligns with a CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CPE cpe:2.3:a:wavlink:wl-wn592ax6:*:*:*:*:*:*:*:* identifies the Wavlink WL-WN592AX6 product family; EUVD records firmware version WL-WN592AX6 250422 as affected. A public exploit reference is linked from the VulDB advisory.
Know when Wl Wn592Ax6 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Unauthenticated network-reachable command injection (PR:N/UI:N/AV:N/AC:L) yielding arbitrary OS command execution on the device, giving full C/I/A impact; scope unchanged as the compromise stays within the device.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Technical POC Analysis
The flaw is CWE-78, OS command injection.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Wavlink WL-WN592AX6 range extenders running firmware 250422 contain a critical OS command injection flaw in the wmapd daemon that allows network-reachable attackers to execute arbitrary shell commands on the device, and publicly available exploit code exists. No vendor-released patch has been identified, so every unit at this firmware level remains exposed until it is isolated, replaced, or otherwise mitigated. Leadership should care because these low-cost devices are widely deployed in home and small-office networks, where a compromised extender becomes a foothold for lateral movement into connected systems.
No vendor-released patch identified at time of analysis. Interim mitigations: remove or block WAN/internet exposure of the management interface; disable remote management and UPnP; isolate affected extenders on a dedicated VLAN or guest network with no access to internal business systems; restrict management access to trusted administrative hosts; rotate default and administrative credentials; monitor device traffic for anomalous outbound connections or shell activity; replace or retire devices where isolation is not feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB