Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-109110: Wavlink WL‑WN592AX6 allows remote command execution
CVE-2026-109110 · published 2 days ago
Summary
The Wavlink WL‑WN592AX6 device contains a flaw in its wmapd service that lets an attacker send specially crafted data to run commands on the device. This can be triggered from outside the network, potentially giving a malicious user control over the device. Apply any vendor‑provided update or disable the vulnerable service until a patch is available.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wavlink | wl-wn592ax6 | 250422 |
Original advisory text
Wavlink WL-WN592AX6 wmapd system os command injection
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.3
Critical
Type
CWE-78OS Command Injection
CWE-77Command Injection
Timeline
Published13 Oct 2026
Updated15 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta