Wl Wn592Ax6
Monthly
OS command injection in Wavlink WL-WN592AX6 firmware 250422 allows unauthenticated network attackers to execute arbitrary shell commands through the wmapd daemon's system function when they can reach the device management surface. The flaw is tracked as CVE-2026-109110 (CWE-78) with a 9.3 CVSS v4.0 score, and publicly available exploit code exists, though no confirmed active exploitation is indicated in the supplied data. Exploitation requires network access to the affected management interface; because this consumer range extender is typically LAN-facing, Internet exposure depends on WAN exposure or an attacker on the local/adjacent network.
A remotely triggerable null pointer dereference in the Wavlink WL-WN592AX6 range extender's web management interface (firmware build 250422) allows unauthenticated attackers to crash the /cgi-bin/upload.cgi handler by sending a crafted Cookie header, resulting in a denial of service. Publicly available exploit code exists (no CISA KEV confirmation), and the CVSS 4.0 base score is 6.9, but our independent assessment rates the practical risk as low-to-moderate because these devices are typically confined to local networks and exploitation requires reachability to the management interface. There is no code execution or data disclosure; the impact is limited to availability of the CGI handler.
OS command injection in Wavlink WL-WN592AX6 firmware 250422 allows unauthenticated network attackers to execute arbitrary shell commands through the wmapd daemon's system function when they can reach the device management surface. The flaw is tracked as CVE-2026-109110 (CWE-78) with a 9.3 CVSS v4.0 score, and publicly available exploit code exists, though no confirmed active exploitation is indicated in the supplied data. Exploitation requires network access to the affected management interface; because this consumer range extender is typically LAN-facing, Internet exposure depends on WAN exposure or an attacker on the local/adjacent network.
A remotely triggerable null pointer dereference in the Wavlink WL-WN592AX6 range extender's web management interface (firmware build 250422) allows unauthenticated attackers to crash the /cgi-bin/upload.cgi handler by sending a crafted Cookie header, resulting in a denial of service. Publicly available exploit code exists (no CISA KEV confirmation), and the CVSS 4.0 base score is 6.9, but our independent assessment rates the practical risk as low-to-moderate because these devices are typically confined to local networks and exploitation requires reachability to the management interface. There is no code execution or data disclosure; the impact is limited to availability of the CGI handler.