CVE-2026-109107: Wavlink WL-WN592AX6 upload.cgi main null pointer dereference
A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Wavlink WL-WN592AX6 devices running version 250422 are identified as affected. The vulnerable component is /cgi-bin/upload.cgi, and the attack can be performed remotely.
Does exploitation require authentication or user interaction?
No authentication or user interaction is indicated by the supplied CVSS vector (PR:N/UI:N). An attacker can trigger the condition by manipulating the Cookie argument sent to upload.cgi.
What is the likely impact of successful exploitation?
The null pointer dereference can affect integrity and availability, as reflected by I:L and A:L in the CVSS vector. Confidentiality impact is listed as none.
How urgent is mitigation?
Public exploit availability is reported, and the CVSS vector marks exploit maturity as proof-of-concept (E:P). The vendor was contacted, but the provided information does not state that a fix is available.