CVE-2026-109110: Wavlink WL-WN592AX6 wmapd system os command injection
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of the Wavlink WL-WN592AX6 running version 250422 are identified as affected. Because the attack can be launched remotely and requires no privileges or user interaction, any reachable affected device should be treated as exposed.
What does an attacker need to exploit it?
The published assessment indicates network access is sufficient: attack complexity is low, no privileges are required, and no user interaction is needed. Exploitation targets the system function in the wmapd daemon and can result in operating-system command injection.
Is there evidence that exploitation is practical?
Yes. An exploit has been published and may be used. The vulnerability is rated critical with impacts to confidentiality, integrity, and availability.