CVE-2026-109110: Wavlink WL-WN592AX6 Unauthenticated OS Command Injection

Overview

A critical, unauthenticated OS command injection vulnerability has been disclosed in the Wavlink WL-WN592AX6 consumer Wi-Fi router. Tracked as CVE-2026-109110 and rated a maximum CVSS score of 10.0, the flaw sits in the system function of the router's wmapd daemon, which fails to sanitize externally supplied input before passing it to the underlying Linux shell. An attacker with network access to the device's management interface can inject arbitrary OS commands with no authentication, no user interaction, and no special privileges required.

The vulnerability was assigned by VulDB, with the vendor contacted ahead of disclosure. As of publication, Wavlink has not shipped a fix.

Technical Details

How It Works

The wmapd daemon on the WL-WN592AX6 builds an OS command string using input that originates from the network-facing management interface. Because that input isn't neutralized before being handed to a shell interpreter, an attacker can smuggle shell metacharacters (such as ;, |, or backticks) into the command, causing the router to execute attacker-controlled commands. Since wmapd typically runs with elevated privileges on embedded Linux firmware, a successful injection gives the attacker root-level control of the device.

Exploitation is rated as easy, requires no authentication, and the vendor advisory notes that technical details and a public proof-of-concept have already circulated.

Impact Assessment

Who Is At Risk

Anyone running a WL-WN592AX6 on firmware 250422 or earlier is vulnerable, particularly deployments that:

• Expose the router's management interface to the WAN side or a broader internal network rather than a trusted admin segment
• Use the device as a primary gateway or Wi-Fi access point for a home office or small business
• Haven't disabled remote management

Potential Attack Chains

1. Network Access — Attacker reaches the device's management interface, either on the LAN or, if remote administration is enabled, over the WAN
2. Command Injection — Attacker sends a crafted request that smuggles shell metacharacters into the vulnerable wmapd function
3. Root Execution — The injected command runs with the daemon's elevated privileges
4. Full Device Takeover — Attacker can pivot to traffic interception, DNS hijacking, botnet recruitment, or using the router as a foothold into the rest of the network

A compromised router sitting at the network edge gives an attacker visibility into — and control over — all traffic passing through it, making this a high-value target despite affecting a single consumer-grade device line.

Mitigation

Immediate Actions

Because no vendor patch is currently available, mitigation is limited to reducing exposure:

• Disable remote/WAN-side management on the router immediately if enabled
• Restrict access to the management interface to a trusted, isolated management VLAN or a small allow-list of admin IPs
• Monitor Wavlink's support channels for a firmware update addressing CVE-2026-109110 and apply it as soon as it's released
• Consider replacing the device with actively supported hardware if it sits on a network segment that can't be adequately isolated

Detection Opportunities

• Review router logs (where available) for unexpected administrative commands, service restarts, or configuration changes
• Watch for unusual outbound connections or DNS changes originating from the device, which can indicate it has already been compromised
• Flag any wmapd-related requests containing shell metacharacters (;, |, `, $()) at the network edge

Defence-in-Depth

• Segment IoT and SOHO networking gear away from sensitive internal systems
• Disable UPnP and other auto-exposure features on routers and the upstream firewall
• Maintain an inventory of network edge devices and their firmware versions so vulnerable hardware can be identified quickly when new advisories land

Discovery & Disclosure

CVE-2026-109110 was reserved on October 12, 2026, and published on October 13, 2026, with VulDB as the assigning CNA. The vendor was contacted as part of the disclosure process. The flaw is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but given the unauthenticated, zero-interaction attack path and reports of a circulating proof-of-concept, defenders should treat exposed devices as at immediate risk rather than wait for confirmed in-the-wild exploitation.

References

• NVD — CVE-2026-109110
• VulDB — CVE-2026-109110
• Strix — CVE-2026-109110: WL-WN592AX6 Command Injection (CVSS 10)